Restrict Lending Pool Borrow/Repayment to Authorized Borrowing Contract

[ayshadogo]

Summary
Adds borrowing-contract authorization enforcement to the lending pool. borrow, repay, and update_debt are now gated so only a single, immutable borrowing-contract address per pool may invoke them. Direct user calls return Error::Unauthorized. All read-only accounting endpoints remain public.

Problem
Lending-pool borrow and repay operations could be called by any address, allowing direct callers to manipulate debt and liquidity accounting outside Vaulty's collateral checks in the borrowing contract.

Changes
New files:

• Contract/lending/src/authorization.rs — require_borrowing_contract() helper that checks env.transacter().address() against the stored borrowing-contract address
• Contract/lending/src/state.rs — Documents the storage layout, immutability guarantee, and initialization order
• Contract/lending/tests/test_lending_borrow_authorization.rs — 14 dedicated authorization tests

Closes #117