feat: verify and enforce authorization and roles

[hpmaxi]

Summary of changes

• Enforce strict caller authentication: eliminate decorative _caller parameters across AsyncVault, ShareToken, NavOracle, and IdentityVerifier by explicitly calling caller.require_auth().
• Add comprehensive unauthorized caller refusal tests for every privileged entrypoint across all four contracts:
  • ShareToken: pause, unpause, mint, burn, forced_transfer, set_address_frozen, freeze_partial_tokens, unfreeze_partial_tokens, recover_balance, set_compliance, set_identity_verifier.
  • IdentityVerifier: allow and allowlist verification enforcement.
  • NavOracle: set_config and clear_latest refusal for unauthorized callers.
  • AsyncVault: cancel_wind_down_proposal refusal for non-admin.
• Document the dual manager role distinction (AsyncVault epoch closure vs. ShareToken mint/burn/forced transfer) and script deployment safety.
• Document why compliance and attester are validated in AsyncVault::__constructor (separation of duties).
• Document all open entrypoints (fund, fulfill_epoch, activate_wind_down, finalize_wind_down_round, claim_wind_down) and their sound design rationale.
• Add docs/AUTHORIZATION_MATRIX.md and link in docs/strata-product-and-architecture.md.

Closes #78

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
strata-vault-kit-app	Ready	Preview	Sep 25, 2026 6:21pm UTC

[luchobonatti]

Tests and clippy are green and the matrix is the right deliverable for #78. Two inconsistencies I would fix before merging, inline.

[luchobonatti]

Matrix now matches the code row by row, and every cited test exists. Recording the share token renounce_admin gap here and fixing it in #169 is the right split. Workspace suite, clippy and fmt clean.