fix(contract): real token transfer in deposit()

[ZacLou]

Closes #55

Problem

The deposit function in contracts/src/lib.rs updated the portfolio's internal balance record but never transferred actual tokens from the caller to the contract. After calling deposit, the portfolio showed a balance that didn't match the contract's real token holdings — allowing users to get credit without depositing real assets.

What this PR fixes

• Import token::Client from soroban_sdk
• Add token_client.transfer() call in deposit() to move real tokens from the caller to the contract address before updating the internal balance
• If the transfer fails (insufficient balance, unauthorized), the entire transaction reverts — internal balance is never updated
• Removed placeholder comment about allowing any asset

Key details

• Transfer uses Soroban's standard token interface (token::Client)
• The caller must have authorized the contract to spend their tokens (standard Soroban token flow)
• Transfer happens after require_auth() but before balance update — fail-fast on insufficient funds
• Contract address obtained via env.current_contract_address()

Acceptance criteria

• deposit transfers tokens from caller to contract via Soroban token interface
• Internal balance only updates after successful transfer
• Insufficient balance reverts the entire transaction (transfer panics before balance update)
• Portfolio owner verification still works (require_auth)
• Emergency stop check still works