Fix contract bounds and reputation issues

[SharifIbrahimDev]

Description

This PR addresses several major smart contract vulnerabilities ranging from unbounded storage vectors, unconstrained storage writes, logic description discrepancies, and missing admin interventions for reputation systems.

Changes Included:

• Shipment Pagination: get_shipments_by_shipper and get_shipments_by_carrier now support offset and limit constraints for safe reading.
• Creation Bounds: Safely restricted string lengths (255 max on origin/destination, 1024 on description) and established a weight_kg upper boundary of 1,000,000 to prevent malicious ledger consumption.
• Scoring Clarity: Rectified documentation inaccuracies for Shipper score distributions, bringing docs firmly in alignment with the underlying code constraints. Added tests to secure formula outputs.
• Rating Interventions: Granted Admin capability to definitively void_rating when addressing bad-faith or erroneous score submissions, restoring proper reputation aggregations.

Fixes

Closes #1394
Closes #1395
Closes #1404
Closes #1405

[vercel]

Someone is attempting to deploy a commit to the Mftee's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@SharifIbrahimDev Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[mftee]

Resolved a substantial merge conflict with main: this PR was based on the pre-module-split reputation and shipment crates, and #1438 (already merged) split both into contract.rs/rating.rs/stats.rs/shipper.rs/storage.rs etc. Rather than resolving the textual diff in the now-slim lib.rs files, I reapplied this PR intent into the correct split-out modules:

• reputation/src/rating.rs: added void_rating (admin voids a bad rating, reverses its effect on the rated user aggregate, frees the rater to re-rate) plus its delegation in contract.rs and tests in test/rating.rs.
• reputation: the score-formula doc fix was already applied on main (stats::score already computes success_pct*3 for shippers) - kept main as-is and added the shipper-score regression test into test/stats.rs instead of re-touching working code.
• shipment/src/shipper.rs: added the max-weight and string-length bounds checks to create().
• shipment/src/storage.rs + contract.rs: added pagination (offset/limit) to get_shipments_by_shipper/by_carrier via a new storage::paginate helper, and updated the one existing test that called the old signature.

Verified no other callers of the two changed function signatures exist elsewhere in the repo. Good fixes for the contract bounds and reputation issues - approving.