security: add audit checklist and formal verification tests

[fathiaoyinloye]

closes #16

Description

Prepare the smart contracts for mainnet security review by adding a structured security audit checklist, running static analysis, and defining formal verification specifications for critical contract invariants.

What changed

• Added a security audit checklist covering:
  • Reentrancy
  • Integer overflow and underflow
  • Access control
  • Front-running
  • Oracle manipulation
• Ran cargo audit to identify dependency vulnerabilities.
• Configured cargo clippy with -D warnings for strict static analysis.
• Added formal verification specifications for:
  • Betting payout correctness
  • Player NFT ownership invariants
• Reviewed all unsafe blocks and documented their purpose and security justification.
• Added or updated tests covering the defined security invariants.

Verification

• cargo audit completed with no high or critical vulnerabilities.
• cargo clippy -- -D warnings passes successfully.
• Formal verification tests cover betting payout correctness and player NFT ownership invariants.
• All unsafe blocks are documented and justified.
• Existing contract tests continue to pass.

Security Considerations

This PR establishes the security review baseline required before mainnet deployment and provides explicit checks for critical contract behavior and invariants.

[Divineifed1]

@fathiaoyinloye kindly resolve conflicts