fix(referral): depth limit, cycle detection & sybil bonus guard (#74)

[Anichris-koded]

Summary

Fixes #74 — unbounded referral chain depth, cycle vulnerability, and sybil fee farming via unconditional welcome bonus.

Changes

referral_registry/src/lib.rs

Depth limit

• Added MAX_REFERRAL_DEPTH = 5 constant
• Added ReferralDepthExceeded = 7 error variant
• On registration with a referrer, the contract now walks the referrer's ancestor chain (up to MAX_REFERRAL_DEPTH hops) and rejects if the limit is already reached

Cycle detection

• Added ReferralCycle = 8 error variant
• The same ancestor walk checks whether user already appears in the chain, rejecting both direct (A→B, B→A) and indirect (A→B→C, C→A) cycles

Sybil bonus guard

• Moved the welcome bonus (WELCOME_BONUS_POINTS + WELCOME_BONUS_TOKENS) inside the if let Some(referrer) block — solo registrations no longer earn tokens, eliminating the primary incentive for sybil chains
• Fixed broken reward_bonus cross-contract call (function never existed on leaderboard) → correct add_bonus_pts + direct mint calls

prediction_market/src/tests.rs

• Fixed pre-existing set_token → set_token_contract typo in test setup

Tests

Test	Covers
test_referral_depth_limit_exceeded	Chain of 6 → panic Error(Contract, #7)
test_referral_depth_at_limit_accepted	Chain of 5 → accepted
test_referral_cycle_direct	A→B, B→A → panic Error(Contract, #8)
test_referral_cycle_indirect	A→B→C, C→A → panic Error(Contract, #8)
test_no_bonus_without_referrer	Solo registration → 0 pts, 0 PULSE
test_welcome_bonus (updated)	Referred registration → 5 pts, 1 PULSE

Result: cargo test -p referral_registry → 20/20 passed