fix: require fee proxy receiver to match sender

[jynbil1]

Fixes #1.

This implements Bounty 2A from #2.

Summary:

• Rejects proxy calls when receiver differs from msg.sender.
• Applies the check to createAtoms, createTriples, deposit, and depositBatch.
• Adds regression tests for all four entrypoints so a malicious or misconfigured dApp cannot route user-funded shares to an arbitrary receiver.

Validation:

• npm test passes: 38 passing.