fix(referral_registry): reject unregistered referrers in register_referral

[Anichris-koded]

Summary

Fixes #71

register_referral accepted any referrer: Option<Address> with no check that the address was a registered user. This allowed:

• Fee routing to attacker-controlled addresses
• Inflation of ReferralCount/ReferralEarnings for non-participants

Changes

referral_registry/src/lib.rs

• Added UnregisteredReferrer = 7 to ReferralError
• Added a guard in register_referral immediately after the self-referral check:

  if !Self::is_registered(env.clone(), ref_addr.clone()) {
      return Err(ReferralError::UnregisteredReferrer);
  }

  Uses the existing is_registered() helper, which handles both the new Profile key and legacy Registered key — so legacy users remain valid referrers.

referral_registry/src/tests.rs

• Added test_reject_unregistered_referrer — asserts Error(Contract, #7) when a never-registered address is used as referrer
• Updated 5 existing tests to pre-register the referrer before using them: test_register_with_referrer, test_credit_with_referrer, test_earnings_accumulation, test_referrer_bonus_points_accumulate, test_referral_count_tracking
• Fixed points assertions in test_credit_with_referrer (5 welcome + 3 credit = 8) and test_referrer_bonus_points_accumulate (5 welcome + 3×3 credit = 14)

What was tested

• All referral_registry tests reviewed and updated to pass under the new validation rule
• No other contracts are affected (the guard is entirely within register_referral)