Add differential fuzzing for invoice and operator privilege boundary test

[amandasmyths]

Summary

Implements two issues that improve test coverage and catch potential logic bugs through differential testing:

• Add a differential fuzzing harness comparing invoice's amount-validation logic against a Python/JS reference model #471: Add differential fuzzing harness comparing invoice's amount-validation logic against a Python reference implementation
• Add a test verifying compliance's require_admin_or_operator correctly distinguishes operator from admin privileges #472: Add test verifying compliance's operator privilege boundary is correctly enforced

Resolves

Closes #471
Closes #472

Changes

Issue #471 - Differential Fuzzing for Invoice Amount Validation:

• scripts/reference_amount_validation.py: Minimal Python reference implementation of invoice amount/precision validation rules
• contracts/invoice/tests/amount_validation_differential_test.rs: Differential fuzzing test that:
  • Generates randomized test inputs
  • Calls Rust implementation via contract creation
  • Calls Python reference implementation
  • Asserts both implementations agree on success/failure
  • Covers canonical cases, boundary cases (around USDC_FACTOR), and off-by-one scenarios
• contracts/invoice/Cargo.toml: Added serde_json dev dependency for JSON communication with Python script

Issue #472 - Operator Privilege Boundary Test:

• contracts/compliance/tests/operator_privilege_boundary_test.rs: 6 comprehensive tests that verify:
  • Operator can successfully call address_status (operator-permitted endpoint)
  • Operator is correctly rejected from allow_address, block_address, clear_address (admin-only operations)
  • Admin retains full access to all operations even after operator is assigned
  • Operator privilege distinction is consistently enforced across multiple operations
• contracts/compliance/src/lib.rs: Added missing DataKey variants (LastBulkAllow, LastBulkBlock) required by bulk operation cooldown tracking

Testing

Both test suites pass:

• cargo test --package comebackhere-invoice --test amount_validation_differential_test ✓ (3/3 tests pass)
• cargo test --package comebackhere-compliance --test operator_privilege_boundary_test ✓ (6/6 tests pass)

The differential test validates that Rust and Python implementations produce identical results across 1000+ test vectors covering:

• All error cases (zero amounts, negative amounts, precision violations, gross < amount)
• Valid ranges (minimum valid amounts, round multiples of USDC_FACTOR, large values)
• Boundary conditions (values one below/at/above USDC_FACTOR threshold)

[drips-wave]

@amandasmyths Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits