fix(blend-adapter): move authorize_as_current_contract immediately before submit()

[escaprt]

Summary

Fixes the production bug where every deposit() into �lend-usdc-fixed fails with HostError: Error(Auth, InvalidAction).

Root Cause

deposit() called �uthorize_as_current_contract() and then made two cross-contract calls (get_reserve, get_positions) before calling submit(). Soroban's InvokerContractAuthorizationTracker is torn down as soon as the next sub-invocation returns and the call stack unwinds — it does not survive across multiple independent cross-contract calls. The tracker was therefore already gone by the time submit() triggered the nested usdc.transfer(adapter, pool, amount), causing the auth rejection.

Fix

Moved �uthorize_as_current_contract() to immediately precede client.submit(), with no intervening cross-contract call. The pre-auth is now live exactly when submit() needs to consume it.

Regression Test

Added deposit_authorization_tree_matches_the_real_pool_call_shape, which runs under mock_auths (real auth-tree validation) rather than mock_all_auths_allowing_non_root_auth. The latter bypasses Soroban's enforcer entirely, which is why the original bug was never caught by the test suite. If �uthorize_as_current_contract() is ever moved back before the read calls, this test will fail with Auth(InvalidAction).

Closes #650

[vercel]

@escaprt is attempting to deploy a commit to the Collins' projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@escaprt Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits