Restrict Keeper authorization in harvest_yield

[Code-Paragon]

Problem

The harvest_yield function verifies that the keeper signed the transaction (keeper.require_auth()), but it never checks if that keeper is actually an authorized protocol address, meaning anyone can call it.

Expected behavior

The DataKey enum is expanded to include a Keeper role, which is set during initialization and explicitly validated against the caller in harvest_yield.

Files to update

• src/lib.rs
• src/strategy.rs
• src/test.rs

Project relevance

This fixes a critical authorization flaw, ensuring that only trusted, whitelisted keeper networks can trigger automated yield strategies.

Acceptance criteria

• Feature works as described
• Tests are added or updated where needed
• Documentation is updated where needed
• env.storage().instance().get(&DataKey::Keeper) is checked against the signed caller address
• No TypeScript, lint, test, or build errors