feat(contract): allow-list reward tokens on-chain

[thefifthdev]

Problem

Any token can currently be used as a reward.

Acceptance criteria

• Admin-managed token allow-list
• post_quest rejects non-listed tokens
• Tests