migrate initialize

[codefather2026]

Closes #33

Summary

• replaces the separately callable initialize(admin, treasury, fee_bps) entrypoint with Soroban's atomic __constructor in escrow, milestones, and maintenance-pool
• passes constructor arguments during deployment in the JavaScript helper and Makefile targets, and prevents the generic invoke helper from presenting initialization as a valid post-deploy operation
• migrates test registration to generated constructor arguments and retains coverage for configuration and admin authorization
• updates contract API documentation, deployment instructions, and the access-control audit to describe the closed front-running window
• marks the existing testnet contract IDs as legacy and documents redeployment under new IDs plus downstream configuration updates

Why

Requiring authorization from the named admin did not prevent an attacker from winning the first initialization transaction by naming themselves. Running configuration as part of Soroban's contract-creation host operation makes deployment and initialization atomic, so no callable uninitialized instance or first-caller-wins window exists.

Validation

• cargo test --workspace
• cargo build --target wasm32v1-none --release -p mergefi-escrow -p mergefi-milestones -p mergefi-maintenance-pool

[vercel]

@Jumongweb is attempting to deploy a commit to the chonilius' projects Team on Vercel.

A member of the Team first needs to authorize it.