[SEC-01] Add hospital ownership constraint to complete_maintenance

[licette32]

Add an authorization constraint to complete_maintenance validating that the hospital signer matches the asset's stored owner — a prerequisite for safely enabling escrow release. Depends on no other issue; standalone fix in programs/medovant/src/lib.rs.

Requirements

• Add has_one = hospital (or equivalent constraint = clause) to the medical_asset account validation inside the CompleteMaintenance accounts struct, mirroring the pattern already used in ReportIssue and DecommissionAsset.
• Confirm technician_profile.technician == technician.key() remains intact alongside the new constraint — both signer roles should be validated independently.
• Review RegisterTechnician's accounts struct for a parallel gap; document whether a hospital-scoped constraint applies there or is out of scope (registration may be intentionally hospital-agnostic).
• Add an Anchor test case that attempts complete_maintenance with a hospital signer that does not match medical_asset.hospital and asserts the transaction fails with the expected Anchor error.

File / Screen Inventory

• Modified: programs/medovant/src/lib.rs (accounts struct constraint)
• Modified/New: Test file under tests/ (failure-path coverage)
• Artifacts: Regenerate IDL/types if the accounts struct changes affect @coral-xyz/anchor client bindings.

Acceptance Criteria

• complete_maintenance rejects any hospital signer that does not match medical_asset.hospital, verified by an automated test.
• Existing passing test suite remains green (no regression to hospital/technician dual-signature flow).
• RegisterTechnician gap explicitly noted as in-scope or out-of-scope with one sentence of justification.