feature:set_authorized_caller and deduction authorization matrix

[Amizeey]

closes #229

Description
Configure which address may invoke deduct flows alongside the owner; emit an audit-friendly event on changes.

Requirements and context
Avoid invalid addresses if they are meaningless on Stellar for this contract.
Document operational migration from owner-only metering to backend-signed metering.
Suggested execution
Fork the repo and create a branch: git checkout -b feature/vault-authorized-caller
Implement changes in the Callora-Contracts Soroban workspace (contracts/*/src/).
Run cargo fmt, cargo clippy --all-targets --all-features -- -D warnings, and cargo test from the workspace root.
For WASM release builds: cargo build --target wasm32-unknown-unknown --release -p callora-vault (adjust -p if the crate name differs).
Deliverables

lib.rs + test.rs.
ACCESS_CONTROL.md updates.
Matrix tests: owner allowed, authorized caller allowed, others rejected.
Test and commit
Run tests and ./scripts/coverage.sh (or cargo tarpaulin per tarpaulin.toml).
Cover edge cases; include summarized test output and brief security notes in the PR description.
Example commit message

feat(vault): authorized caller for metering
Guidelines
Minimum 95% line coverage for touched crates (workspace policy).
Clear documentation (Rust /// on public items where applicable; repo markdown as needed).
Timeframe: 96 hours from assignment unless agreed otherwise.

[drips-wave]

@Amizeey Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits