Contracts: Bound merkle-proof depth in `register` to prevent gas-exhaustion DoS

[joelpeace48-cell]

Context

campaign::register(env, participant, leaf, proof) (lib.rs ~L328) verifies a Merkle proof against a
stored root. If proof length is unbounded, an attacker can submit huge proofs to waste resources, and
roots with pathological depth can make legitimate registration too expensive.

Scope

• Enforce a max proof length / max tree depth.
• Reject malformed proofs early with a typed error.
• Document the supported allowlist size vs depth.

Acceptance criteria

• Oversized proofs revert cheaply.
• Tests for max-depth boundary and rejection.

[gloskull]

Hello, I have 4 years of experience delivering solutions for projects like this, covering backend, frontend, and smart contract development. After carefully reviewing your requirements, I have a clear understanding of the task and am confident in my ability to deliver a clean, efficient, and thoroughly tested solution on time. I prioritize code quality, maintainability, and industry best practices throughout the development process. My PR will be submitted in under 10hours.