fix: live protocol fee, EVM chain validation, chain_id bounds, scoped auth

[quartune]

Summary

Combined fix for four assigned issues:

• [High] Fix fill_intent's protocol fee to honor the live, admin-configured rate #260 — fill_intent now reads protocol_fee_bps from the live set_config-managed ProtocolConfig instead of the compile-time PROTOCOL_FEE_BPS constant, so admin fee-rate changes actually take effect.
• [High] Fix validate_src_token missing Avalanche/BSC branches #261 — validate_src_token's EVM chain set now includes "avalanche" and "bsc", closing a silent format-validation gap for those two chains.
• [High] Add u16 bounds validation for proof_registry's chain_id #262 — proof_registry::set_authorized_emitter now rejects chain_id > u16::MAX, since the real Wormhole chain-ID space is 16 bits.
• [High] Audit all require_auth() call sites for require_auth_for_args upgrade opportunities #263 — Audited every require_auth() call site in intent_settlement (see new docs/auth-audit.md); upgraded submit_intent, accept_intent, and fill_intent to require_auth_for_args scoped to their load-bearing arguments, per the audit's own prior in-code notes. All other sites were reviewed and kept as require_auth() with documented rationale.

Also updates docs/pre-deploy-security-checklist.md (checks off #45), docs/solver-integration-guide.md (notes the scoped-auth change for solver bot authors), and CHANGELOG.md.

Validation performed

• Reviewed each changed call site against its issue's acceptance criteria and cross-checked the EVM chain list against README.md and docs/132-supported-chains.md.
• Added regression tests: avalanche/bsc EVM validation (accept + reject), set_config-driven fee honoring, set_authorized_emitter u16 boundary (accept at u16::MAX, reject above), and a mismatched-args MockAuth test proving fill_intent's new require_auth_for_args scope rejects a delegated auth entry signed for a different intent_id.
• Could not run cargo build/test/clippy: no Rust toolchain is available in this environment. Additionally, main currently fails to compile for reasons unrelated to this PR — several constants used in intent_settlement/src/lib.rs (e.g. DEFAULT_MIN_BOND, MIN_FILL_WINDOW_SECS, MIN_INTENT_EXPIRY_SECS, MIN_BOND_FLOOR, MAX_PROTOCOL_FEE_BPS, SLASH_COOLDOWN, MAX_BATCH_SIZE, MAX_EXTENSION_DURATION) are referenced but never defined. This traces back to a merge conflict in PR feat: add max protocol fee cap and admin audit trail #184 (feat/protocol-fee-cap) that appears to have dropped the constant-definition hunk while keeping the code that uses them. This is a pre-existing, unrelated build-breaking issue and is out of scope for this PR — flagging it here since it will need a separate fix before CI can pass on any branch, including this one.

Closes: #260
Closes: #261
Closes: #262
Closes: #263

[drips-wave]

@quartune Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits