Remove the double require_auth in admin and dispute entrypoints that trap on-chain with Auth, ExistingValue #1457

Summary

docs/TESTING.md records that calling require_auth() twice for the same address in one frame makes the host reject the invocation with Error(Auth, ExistingValue), and that this is "a real runtime hazard". The initialize and collect_fees instances were fixed. At least ten other entrypoints still authenticate in lib.rs and then call a manager that authenticates the same address again, so they cannot succeed on-chain. This issue removes the second authorization in each and adds a guard so the pattern cannot come back.

Background and evidence

I traced these by following each lib.rs entrypoint into its callee:

DisputeManager::process_dispute (~934) already shows the intended pattern: the comment "calls user.require_auth() before delegating here".

Roughly 26 of the tests ignored with #[ignore = "known failing ..."] fail with Auth, ExistingValue (per docs/TESTING.md). Some of them exercise these paths.

Scope

In scope

1. Fix each pair. Keep authentication at exactly one layer, preferably the entrypoint, with require_primary_admin or require_admin_permission. Change the inner manager functions to *_authorized variants that assume auth was done. Keep their identity and permission checks, without require_auth.
2. No public inner auth paths. Mark the inner variants pub(crate), so that no future entrypoint can skip auth by calling them directly.
3. Un-ignore the tests. Remove #[ignore] from the ignored tests that fail only because of these double-auth paths, and fix any fixture drift.
4. Guard against recurrence. Add a test, or a small build.rs-free unit test that walks a list of entrypoints, that calls each one through the generated client using real (non-mocked) auth via env.mock_auths(&[MockAuth { ... }]) with a single auth entry. That is how on-chain behaviour is reproduced.
5. Docs. Update docs/TESTING.md: the ignored count and the "remaining double-auth" note.

Out of scope

• upgrade_contract / rollback_upgrade (tracked in the slim-build upgradeability issue).
• Adding new permissions or roles.

Design constraints

• One require_auth per address per frame on every listed path.
• Error precedence is unchanged: auth, then identity (Unauthorized), then validation, then state.
• Use real auth in tests. mock_all_auths() hides this class of bug. The new tests must use mock_auths with exactly one entry per invocation.
• Size. The full and slim builds both compile. Report the slim WASM size; it is expected to be unchanged or smaller.

Test plan

Add contracts/predictify-hybrid/src/single_frame_auth_tests.rs.

Regression proof. Row 1 for vote_on_dispute and set_treasury fails on current master with Error(Auth, ExistingValue). Paste the failure in the PR.

Acceptance criteria

• No listed entrypoint reaches require_auth twice for the same address (the PR includes a call-chain table).
• The ignored-test count in docs/TESTING.md drops by the number of tests you restored, and cargo test -p predictify-hybrid --lib -- --ignored shows those tests are gone from the ignored set.
• cargo test -p predictify-hybrid --lib passes.
• cargo check -p predictify-hybrid --no-default-features passes.
• Coverage is at least 95% on the touched inner functions.

Getting started

git checkout -b fix/single-frame-auth
cargo test -p predictify-hybrid --lib -- --ignored 2>&1 | grep -B2 ExistingValue | head -50

Read these first:

• docs/TESTING.md (the double-auth explanation)
• lib.rs: require_primary_admin, require_admin_permission
• disputes.rs: process_dispute, which shows the correct pattern

PR requirements

• Link this issue (Closes #<n>).
• Include the call-chain table before and after.
• Paste the test output, including the restored tests, and the coverage.
• Example commit: fix(auth): authenticate once per frame in dispute and treasury entrypoints.

Priority rationale

Medium. Each fix is contained, but together they unblock ten admin and dispute entrypoints that cannot run on-chain, and restore part of the ignored test suite. It requires understanding Soroban's auth recording, beyond what mock_all_auths shows.