security(stream): document exact-deposit transfer, add approval audit test

[devUnixx]

Closes Vera3289#65

Changes

Contract comment (contracts/stream/src/lib.rs)

Added a # Token approval / transfer security (#65) doc-comment to create_stream explaining:

• The contract calls token::transfer(employer → contract, deposit) — exactly deposit, nothing more
• No approve call is issued by the contract itself
• The caller must pre-approve at least deposit tokens; the contract cannot pull more than that single authorisation

Test (contracts/stream/src/test.rs)

Added test_create_stream_transfers_exact_deposit:

• Records employer balance before the call
• Calls create_stream with a known deposit amount
• Asserts employer balance decreased by exactly deposit
• Asserts contract balance increased by exactly deposit

Security posture

The approval model is already minimal (exact-deposit, no unlimited approval). This PR makes that guarantee explicit and machine-verified.