fix: enforce net minimum stake, reentrancy guard, fee accounting, and referral hardening

[Victorakinwunmi]

Summary

Multi-contract hardening fix addressing issues #60, #63, #75-78, #80, #81, and #89.

Changes

leaderboard

• Deprecate �dd_pts in favor of
  eward ([HIGH] reward and add_pts are both callable by the market contract with divergent semantics — double-counting and token-supply divergence #63)
• Add net-minimum-stake enforcement and stale-min self-healing ([LOW] MIN_BET is checked on gross, but the staked amount is net — fee-dependent minimum stake inconsistency #60)

prediction_market

• Add reentrancy guard on place_bet ([CRITICAL] Cross-contract reentrancy in place_bet / credit — check-effects-interaction violation #89)
• Restructure to checks-effects-interaction pattern (all state writes before external calls)
• Track only platform_fee in AccumulatedFees; referral fee stays with referral contract as surplus ([MEDIUM] Legacy key migration creates inconsistent state between pre-upgrade and post-upgrade users #78)

pulse_token

• Add idempotent set_minter /
  emove_minter with audit list and MAX_MINTERS cap ([LOW] set_minter/remove_minter have no idempotency or authorization check on the minter — redundant and confusing minter state #80)
• Extend TTL on mint/burn/transfer balance writes

referral_registry

• Cap referral earnings at 50k XLM ([MEDIUM] No cap on referral earnings — unbounded fee accumulation per referrer #77)
• Retain surplus fees locally instead of round-tripping to caller ([MEDIUM] Legacy key migration creates inconsistent state between pre-upgrade and post-upgrade users #78)
• Validate display_name length (max 64 chars) ([MEDIUM] credit refunds the referral fee to the caller (market contract) when there's no referrer — fragile trust assumption #76)
• Add admin-callable migrate_user for legacy key migration ([MEDIUM] register_referral has no display_name length limit — storage DoS via oversized strings #75)
• Fix ReferrerNotRegistered error code collision ([HIGH] No event emission anywhere — off-chain indexers, UIs, and auditors cannot track state transitions #7 -> [HIGH] get_market_bettors iterates an unbounded bettor index — gas DoS on large markets #8)
• Add TTL extensions on profile and earnings writes ([MEDIUM] transfer/burn don't extend TTL on balance keys — token balances can expire and be lost #81)

Issues closed

Closes #60, #63, #75, #76, #77, #78, #80, #81, #89