Description

Summary

This PR audits predifi-contract authentication paths and ensures authorization is only required once at the transaction entry point.

The change keeps all existing role validation and unauthorized event behavior, but moves shared permission checks into internal helpers that do not call require_auth(). This avoids redundant auth work on the same address and helps reduce unnecessary gas usage.

What Changed

• Refactored shared admin authorization checks into internal helpers
• Refactored operator/oracle resolution role checks into internal helpers
• Kept require_auth() only on public contract entry points
• Preserved existing unauthorized event emission and error handling behavior

Tests

Added regression tests that verify auth is recorded exactly once at the entry point for:

• Admin config update flow
• Creator cap-increase flow
• Operator resolution flow
• Oracle resolution flow

These tests inspect Soroban auth trees directly to ensure we do not re-authenticate the same address within the same invocation path.

Verification

• Ran cargo fmt
• Ran cargo test -p predifi-contract --lib

All tests passed.

Closes #416