feat(contract): add deterministic expiry sweeping with bounded work

[Johnpii1]

closes #189

Motivation
Expired escrowed transfers must be reclaimable without risking unbounded work or double-refunds.
Provide a permissionless, idempotent cleanup mechanism that respects expiry semantics and transaction budgets.

Description
Add a new permissionless entrypoint sweep_expired_batch(start_id: u64, limit: u32) -> Result<Vec, Error> that inspects at most min(limit, MAX_SWEEP_BATCH_SIZE) sequential ids (inclusive cursor, 0 clamped to 1) and refunds only transfers whose ledger_timestamp > expiry, marking them Cancelled and emitting cancelled events (implementation in src/lib.rs).
Introduce MAX_SWEEP_BATCH_SIZE constant (50) to bound per-call work and make retries deterministic and safe (no double refunds).
Update storage and accounting during sweeps: transfer token from contract to recorded sender, decrement TotalEscrowed, call assert_supply_invariant, and extend instance TTL when work occurred.
Add regression/unit tests covering expiry boundary, live-transfer skipping, idempotency, cursor advancement, bounded work, and fund/liability conservation (src/test.rs).
Document the new entrypoint and behavioural guarantees in README.md and docs/entrypoint-reference.md.

Testing
Ran formatting and style checks: cargo fmt --all -- --check and cargo clippy --lib --locked -- -D warnings, which completed successfully.
Ran unit tests: cargo test --locked sweep_expired_batch (targeted) and cargo test --locked (full suite); result: tests passed (full suite: 131 passed, 0 failed, 4 ignored).
Built release WASM: make build and verified artifact budget with ./scripts/test-check-wasm-size.sh, both checks succeeded.
Verified no diff/check issues with git diff --check (passed).