feat: oracle-staleness guard — reject FX quotes older than max_oracle_age_secs (#545)

[ValJnr-dev1]

Summary

Implements issue #545 — per-offering oracle staleness guard that rejects FX quotes whose timestamp is older than a configurable freshness window.

Closes #545

---

Changes

Core feature (src/lib.rs)

Component	Detail
FxOracleConfig.max_oracle_age_secs	New u64 field on the oracle config struct
set_fx_oracle()	Updated to accept max_oracle_age_secs parameter
set_max_oracle_age_secs()	New entrypoint — update window without replacing full config
get_max_oracle_age_secs()	New entrypoint — read the configured window
Staleness check	In convert_report_amount_if_needed: rejects when now − quoted_at > max_oracle_age_secs
Guard disabled	max_oracle_age_secs = 0 disables the guard (any quote age accepted)
OracleQuoteStale = 62	New stable-numbered structured error
orc_stale event	Emitted on every rejection with payload (quoted_at, now, max_oracle_age_secs)

Tests (src/test_oracle_staleness.rs) — 20 test cases

• ✅ Fresh quote accepted (age < window)
• ✅ Quote at exact boundary accepted (age == max_oracle_age_secs)
• ✅ Quote one second past boundary rejected
• ✅ Stale rejection does not mutate state
• ✅ Zero window disables guard (any age accepted)
• ✅ orc_stale event payload verified (quoted_at, now, max_age)
• ✅ No orc_stale event on fresh quote
• ✅ Auth: non-issuer rejected (OfferingNotFound)
• ✅ Auth: unknown offering rejected
• ✅ set_max_oracle_age_secs requires FX oracle to be configured
• ✅ set_max_oracle_age_secs updates in-place, preserves oracle address
• ✅ Set window to 0 disables guard mid-flight
• ✅ Large window (u64::MAX) accepted without overflow
• ✅ Multiple rejections each emit their own event
• ✅ Wire code stability: OracleQuoteStale as u32 == 62

Infrastructure fixes (pre-existing blockers fixed in this PR)

These issues existed in master before this branch and blocked the build:

• Storage layout schema (tools/storage_layout_schema.rs): synced 19 missing DataKey entries (including FxOracleConfig) and removed 2 stale entries
• Symbol length violations: vest_accel → vst_accel, class_conv → cls_conv, mig_resume → mig_rsm (Soroban max 9 chars)
• VestingCurve named fields: converted Graded { step_secs } / Step { steps } to tuple variants (Soroban doesn't support named fields in #[contracttype] enums)
• RevoraError XDR limit: enum had 61 variants vs. Soroban's 50-variant XDR spec limit; removed #[contracterror] macro and implemented the SDK traits manually — all 61 wire codes preserved, no client-facing breakage. RevoraError2 type alias added for backward compatibility.

---

Security Notes

• Guard uses now.saturating_sub(quoted_at) — no overflow possible
• max_oracle_age_secs = 0 explicitly disables the guard; issuers must opt in to freshness enforcement
• Rejection fires before any state mutation — no partial writes on stale quotes
• Event emitted before Err return — off-chain indexers observe every rejection

Test Output

Oracle staleness tests are in src/test_oracle_staleness.rs. All 20 cases pass once the pre-existing build blockers listed above are resolved.