fix(deposit_handler): InvalidMarket for unregistered markets; test coverage for allowance expiry and auth-audit generator

[leojay-net]

Summary

• deposit_handler: load_market_props raises DepositNotFound for an unregistered market during create_deposit #371 (deposit_handler misclassifies unregistered market as DepositNotFound): load_market_props panicked with Error::DepositNotFound when a market's index/long/short token keys were absent from data_store — but this runs during create_deposit before any deposit exists, so DepositNotFound (which means "no such deposit id" everywhere else it's used) was the wrong error. withdrawal_handler already has the correct pattern. Added Error::InvalidMarket to deposit_handler and switched load_market_props to use it, reserving DepositNotFound for actual deposit-key lookups. Added a regression test asserting the specific error code.
• market_token: allowance-expiration branches in allowance() and spend_allowance are untested #362 (market_token allowance-expiration branches untested): no test ever advanced env.ledger() past an approval's expiration_ledger before reading allowance() or spending it, so the expiry branches in allowance() and spend_allowance were never exercised. Added three tests that advance the ledger sequence past expiration and assert allowance() returns 0, and that transfer_from/burn_from both revert with AllowanceExpired.
• docs/auth-audit.md certifies data_store access controls that do not exist / describes nonexistent functions #356 (auth-audit.md certified nonexistent functions): the doc previously listed set_account_principal_delta / get_account_principal_delta, neither of which exist in data_store, and mis-stated get_position_manager as an auth-checked ✅ PASS when it's actually an unrestricted public read. This was already fixed by regenerating the doc from source in a separate merged PR (scripts/gen_auth_audit.py + the Auth Audit Check CI job), but that generator script had no test of its own. Added scripts/test_gen_auth_audit.py, which fabricates a source/doc pair containing both a phantom entry and a missing entry and asserts validate_against_source() catches both — plus a direct check that get_position_manager classifies as read-only, not PASS. Wired it into .github/workflows/auth-audit.yml so it runs on every relevant PR.

Verification

• cargo test -p deposit-handler — 34 passed
• cargo test -p market-token — 15 passed
• python3 scripts/test_gen_auth_audit.py -v — 4 passed
• python3 scripts/gen_auth_audit.py --check — in sync

Note: as with #501, cargo fmt --all -- --check and the WASM Size Budget build currently fail on main itself for pre-existing, unrelated reasons (repo-wide formatting drift, a wasm32-unknown-unknown/soroban-sdk toolchain incompatibility, and — independently discovered while verifying this PR — oracle::register_market_for_circuit_breaker exceeding Soroban's 32-character contract-function-name limit, which also breaks cargo clippy --workspace and a plain cargo check --workspace today via the tests integration crate's dependency on oracle's testutils feature). None of these are touched or worsened by this change.

Closes #371
Closes #362
Closes #356

[drips-wave]

@leojay-net Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits