feat: add per-call max_fee_bps slippage protection to deduct - #519

Summary

Implements issue #498. Adds a max_fee_bps: u16 parameter to deduct that reverts with the new typed VaultError::Slippage (code 35) when the deducted amount expressed in basis points of the current balance exceeds the caller's limit.

calculated_fee_bps = (amount * 10_000) / balance
if calculated_fee_bps > max_fee_bps → VaultError::Slippage

Pass u16::MAX (65535) to disable the guard — backward-compatible default for all existing integrations.

Security rationale

The slippage guard is a pre-mutation check. It fires after input validation and idempotency checks but strictly before any state write or external token transfer. A failed check leaves the vault in exactly the state it was before the call — no partial effects, no balance change. This protects callers against race conditions or unexpected balance drift that could cause a single call to drain a disproportionately large fraction of the vault.

Changes

• lib.rs — Slippage = 35 added to VaultError; max_fee_bps: u16 added to deduct; slippage check inserted before state mutation.
• test.rs — 8 new targeted tests (below/equal/above limit, u16::MAX, boundary 0 and 1 bps, pre-mutation assertion, regression).
• All existing deduct / try_deduct call sites updated to pass &u16::MAX.
• docs/interfaces/vault.json — max_fee_bps param and Slippage (35) error documented.

Closes

Closes #498