Fix/38 reveal key seller auth

[Escelit]

Description:
reveal_key called require_auth() on the stored seller address but never verified the caller was the seller. Any address could pass auth checks (especially under mock_all_auths) and trigger payment release without being the legitimate seller.

Root cause: missing explicit caller == swap.seller assertion before auth.

Fix:

Added caller: Address parameter to reveal_key
Assert caller == swap.seller before caller.require_auth() — the identity check is a hard assert that cannot be bypassed by auth mocking or transaction crafting
Added test_unauthorized_reveal_key_rejected in basic_tests.rs: sets up a real Accepted swap, calls reveal_key with an attacker address, and expects a panic with "only the seller can reveal the key"
Also fixed (pre-existing blockers preventing compilation):

ip_registry: duplicate mod test, missing testutils feature flag, missing symbol_short import, owner borrow-after-move
lib.rs
: removed 5 duplicate stale mod tests blocks that were never compiling
Updated all reveal_key call sites in tests.rs and tests_simple.rs to pass the new caller arg
Tests: cargo test --workspace — 7/7 passing, 0 failures.

Closes #38

[drips-wave]

@Escelit Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Escelit]

Please merge