Audit all require_auth() calls for completeness

[dzekojohn4]

Review every public contract function and confirm require_auth() is called on the correct signer. Document the auth matrix in a comment block at the top of lib.rs: which address must sign for each function.

[2411015047-afk]

Hi! I noticed this is an auth audit task — I have experience reviewing Soroban require_auth() patterns and can do a thorough audit. Would you like to hire this out? I can provide a detailed report with findings and recommended fixes.