refactor: implement contract constructor for initialization and updat…

[PeterOche]

…e escrow deadline validation constraints.

fix(contract): resolve critical security vulnerabilities in deadline validation, initialization, multisig auth, and dispute resolution

Summary

This PR addresses four smart contract security vulnerabilities affecting escrow creation, role initialization, multisig threshold authorization, and dispute payouts.

Closes

• Closes [CONTRACT] create_escrow never validates deadline — InvalidDeadline is dead code #623
• Closes [CONTRACT] Permissionless initializers — first caller becomes admin, operator, arbitrator, and treasury #621
• Closes [CONTRACT] Above-threshold milestone releases require no authorization from any party #622
• Closes [CONTRACT] Unfunded escrows can be disputed and resolved, paying out from other escrows' funds #620

---

Detailed Changes

1. Deadline Validation & Lead Time Enforcement (#623)

• Enforced deadline > env.ledger().timestamp() + MIN_DEADLINE_LEAD_SECS (where MIN_DEADLINE_LEAD_SECS = 60) in both create_escrow and create_escrows_batch.
• Returned Error::InvalidDeadline (12) when a deadline is in the past, equal to the current timestamp, or within the 60s minimum lead time window.
• Updated docs/contract/ERRORS.md error documentation.

2. Atomic Constructor Initialization (#621)

• Replaced permissionless init and initialize functions with Soroban __constructor(env, admin, operator, arbitrator, treasury, fee_bps).
• Added public query is_initialized(env) -> bool for deploy verification and smoke checks.
• Added ensure_initialized(env) gate returning Error::ContractNotInitialized (36) on operational entrypoints (create_escrow, create_escrows_batch, deposit_funds).

3. Multisig Authorization & Signer Validation (#622)

• Added approved_signers: Vec<Address> to Escrow and EscrowEntryV2.
• Updated configure_multisig to require an explicit signers list and validate threshold_amount >= 0, required_signatures > 0, and required_signatures <= signers.len() (returning Error::InvalidSignerConfiguration 37 on invalid configuration).
• Restricted collect_signature to addresses present in approved_signers.
• Enforced that above-threshold release_milestone and confirm_delivery require depositor authorization in addition to meeting the required approved signature count.

4. Unfunded Escrow Dispute & Solvency Accounting (#620)

• Added funded_amount: i128 tracking on EscrowEntryV2 and Escrow, populated upon successful deposit_funds.
• Restricted raise_dispute strictly to EscrowStatus::Active (rejecting Created unfunded escrows with Error::InvalidEscrowStatus).
• Updated invariants.rs state transitions to disallow Created -> Disputed.
• Capped resolve_dispute distributable payouts to min(nominal_outstanding, funded_outstanding), ensuring dispute resolution cannot spend pooled token balances belonging to other escrows.

---

Breaking Changes & Migration Notes

• Deployment: Deployments now require constructor arguments (admin, operator, arbitrator, treasury, fee_bps). Calling separate init() / initialize() methods is removed.
• Multisig Configuration: configure_multisig now requires an explicit signers: Vec<Address> parameter.
• Disputes: Disputes can only be initiated once funds have been deposited (Active status).

---

Testing & Verification

All unit, invariant, and integration test suites pass cleanly:

cargo test --lib

[drips-wave]

@PeterOche Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Cedarich]

LGTM