Fix/proposal cancellation refund

[mijinummi]

Summary

closes #231
closes #232
closes #233
closes #241
Fixed the proposal deposit lifecycle so cancellation and execution correctly handle the economic value represented by a proposal deposit instead of treating the deposit as storage-only bookkeeping.

Changes

• Updated proposal creation to perform the actual token transfer associated with the configured deposit.
• Updated cancel_proposal() to transfer the deposited tokens back to the original proposer before removing the deposit record.
• Updated proposal execution/settlement handling to account for the deposited tokens according to the proposal lifecycle.
• Preserved the proposer/deposit relationship required to authorize refunds.
• Added validation around deposit amounts, token transfers, and proposal state transitions.
• Added regression tests covering deposit creation, cancellation/refund, execution, and invalid or unauthorized operations.

Security & Accounting

• Eliminates the previous state where cancelling a proposal removed the deposit record without moving any tokens.
• Ensures the recorded deposit corresponds to an actual token balance held by the contract.
• Prevents deposits from becoming permanently inaccessible due to storage-only accounting.
• Ensures refunds are restricted to the appropriate proposer and valid cancellation state.

Validation

• Verified deposit tokens are transferred into the contract when a proposal is created.
• Confirmed cancellation returns the deposited amount to the proposer.
• Verified the deposit record is removed only after the corresponding refund succeeds.
• Tested proposal execution and the associated deposit lifecycle.
• Confirmed unauthorized cancellation and invalid lifecycle transitions are rejected.
• Ran the relevant Soroban contract tests and checks.

Acceptance Criteria

• Integrate real token transfers into the proposal deposit flow.
• Return the deposit to the proposer when a proposal is cancelled.
• Handle the deposit correctly during proposal execution.
• Prevent storage-only deposit bookkeeping from misrepresenting token custody.
• Add regression coverage for deposit creation, refund, and settlement.

[drips-wave]

@mijinummi Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits