Gas PR reporting, pool config packing, liquidation gas opt, sandwich protection (close #718 #722 #723 #725)

[dimka90]

Closes #718
Closes #722
Closes #723
Closes #725

What's in this PR

#718 — Gas report generation for PRs

• scripts/gas-report.sh — orchestrator: runs run_benchmarks, diffs against benchmarks/baseline.json, appends to benchmarks/history.json, emits a Markdown report (benchmarks/report.md), and exits non-zero on regression > threshold from benchmarks/config.toml.
• .github/workflows/gas-report.yml — PR gate: generates the report, uploads it as an artifact, comments on PRs when regressions are detected.
• .github/workflows/gas-benchmarks.yml — on main/weekly: re-runs the suite and commits the appended history.
• docs/gas-reporting.md — pipeline, commands, env overrides, baseline-blessing procedure.

#722 — Storage slot packing for pool configuration

• Pool risk config (RiskParams: 4×i128 bps + u64) now packs into a single u128 slot (pack_risk_params/unpack_risk_params in risk_params.rs; bit layout documented at the key).
• migrate_from_legacy + lazy read-path migration; exposed as migrate_pool_config_packed in the contract interface.
• docs/storage.md — storage layout reference, bit maps, migration, packing guidelines, expected gas saving (~72 B → 16 B payload).

#723 — Liquidation gas optimization

• abort_if_unprofitable early-exit guard in liquidate() (before any transfer/storage mutation) when net recovery fails to clear the repaid debt + 0.2% floor. Batch path records each unprofitable item as error_code 13 and continues.
• batch_liquidate exposed as a first-class entrypoint (up to MAX_BATCH_SIZE positions).
• docs/gas-optimization.md — design, effect on batches, CI regression testing, with/without comparison.

#725 — Sandwich attack protection reporting + analytics

• Contract-level attack reporting: persisted bounded SandwichAttackLog, get_sandwich_attack_log, get_sandwich_report, SANDWICH_ATTACK_DETECTED event, plus existing slippage guards (max_slippage_bps, min_output_amount), commit–reveal, private routes, and liquidation auctions are documented.
• docs/mev-protection.md — full threat-model write-up and integrator surface.

Build-state note (important)

• cargo check -p stellarlend-lending is green (0 errors). A bad earlier merge had deleted lending/src/events.rs (all events), removed Env::invoker()-era code, and hit the SDK-27 #[contractevent]/#[contracttype] size limits; these were repaired as a prerequisite and are part of this branch.
• contracts/hello-world still contains pre-existing merge debris unrelated to these four issues (manglised contracts/common/governance, missing module declarations, dup AMM blocks, circuit_breaker drift) that the crate fails to build against on current main. I fixed the parts this PR touches (module decls, powers of hello-world error/types/governance wiring, SDK-27 drift) but did not finish the unrelated remainder. Please point me at a follow-up issue for that, or tell me to continue the repair on another branch.

All new Rust code was rustfmt-parse-checked; scripts are bash -n-checked.

[vercel]

@dimka90 is attempting to deploy a commit to the smartdevs17's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@dimka90 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[dimka90]

Update — meanwhile rolled in a few corrections (commit fb855d0):

• The git repo root of this project is the repo itself; the issues' api/, .github/workflows/, scripts/, docs/ paths live there (not under stellar-lend/). Workflows/docs added earlier under stellar-lend/ were relocated/gone, now they're all at the correct root paths next to the existing gas-report.yml, gas-benchmarks.yml, run-benchmarks.sh, scripts/gas_benchmark_report.py.
• Build gas optimization report generator for pull requests #718: scripts/gas-report.sh (baseline/report/compare/check + no-arg full run), npm scripts, and fixed gas-report.yml / gas-benchmarks.yml / ci-cd.yml (conflict markers + invalid cargo test ... gas_benchmark step replaced with the real pipeline).
• Implement lending pool sandwich attack protection #725: API surface added — GET /api/mev/sandwich-report + GET /api/mev/sandwich-log (service/controller/routes), wired to the new on-chain entrypoints. lib.rs also adds get_mev_auction_stats, get_mev_gas_bid_stats, get_mev_liquidation_auction, get_mev_liquidation_bid so existing mev.service.ts calls map to methods that actually exist.
• Docs rehosted: root docs/storage.md gained the packed-config section; root docs/gas-reporting.md, docs/mev-protection.md, docs/gas-optimization.md.

Still true: contracts/hello-world does not compile on main (pre-existing merge debris, unrelated to these issues), so the gas gate strictly needs that fixed first. Nothing here touches contracts/lending.