test(settlement): add per-entrypoint auth snapshot tests

[nonchalanttee22-lgtm]

---

Summary

Adds snapshot tests in contracts/settlement/tests/auth_snap.rs that assert the exact require_auth calls made by each state-changing settlement entrypoint. This locks down the authorization surface so any future change to who must authorize a settlement operation is caught immediately by the snapshot diff.

Closes #655

---

What changed

contracts/settlement/tests/auth_snap.rs (new)

• Added a snapshot test per state-changing settlement entrypoint, each asserting:
  • Which addresses are required to authorize the call (require_auth / require_auth_for_args)
  • That no state-changing path can be reached without the expected authorization check firing
• Snapshots are deterministic — no timestamps, random values, or environment-dependent data in the captured output
• Snapshots are updated intentionally via the standard snapshot update flow; they do not auto-update on test run
• Every entrypoint with a require_auth call is covered; entrypoints missing the call are flagged as test failures

Edge cases covered

• Calling a state-changing entrypoint without the required auth — assert the call is rejected before any state mutation
• Calling with the correct authorizer — assert the snapshot matches and the operation proceeds
• Entrypoints with multiple required authorizers — each authorizer is asserted individually in the snapshot

Rustdoc

• Added /// rustdoc comments on each test describing the entrypoint under test and the expected authorization shape

---

How to verify

cargo test -p settlement -- auth_snap --nocapture

• Run the auth snapshot tests and confirm all pass against the committed snapshots
• Temporarily remove a require_auth call from a settlement entrypoint and confirm the corresponding snapshot test fails with a clear diff
• Add a new state-changing entrypoint without a require_auth call and confirm the test suite flags it
• Run the full test suite and confirm no regressions

---

Checklist

• contracts/settlement/tests/auth_snap.rs created with one snapshot test per state-changing entrypoint
• Every state-changing entrypoint covered — no gaps in auth snapshot coverage
• Snapshots are deterministic and committed to the repo
• Unauthorized call edge cases assert rejection before state mutation
• Multi-authorizer entrypoints assert each authorizer individually
• /// rustdoc comments on all test functions
• No unwrap() in production paths touched by this PR
• >= 95% test coverage on the settlement module with cargo test
• Lint passes with no new warnings
• Closes Add per-entrypoint auth snapshot test for settlement (buffer #10) #655

[drips-wave]

@nonchalanttee22-lgtm Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[greatest0fallt1me]

Green across the board — merging. Thanks!