fix(archive): bound archive queries, historical reads, and pagination cursors (#1379)

[s6pa1rta3n-lab]

Summary

Fixes #1379

Bounds archive queries, historical reads, and pagination cursors to prevent unbounded iteration, out-of-bounds indexing, and transaction budget exhaustion.

Problem

Issue #1379 identified unbounded historical reads and archive query vulnerabilities:

• Query endpoints accepted arbitrary limits or did not enforce a safe lower-bound default when limit was 0.
• Out-of-bounds cursor inputs caused needless iteration or unsafe slice operations.
• prune_archive allowed excessive batch sizes in a single transaction.

Changes

• Archive Query Bounding (event_archive.rs):
  • Defined MAX_QUERY_LIMIT = 30, DEFAULT_QUERY_LIMIT = 10, and MAX_PRUNE_BATCH = 30.
  • Added sanitize_limit(limit: u32) -> u32 to clamp 0 to DEFAULT_QUERY_LIMIT and cap oversized inputs to MAX_QUERY_LIMIT.
  • Added early exit when cursor >= total, returning (Vec::new(env), total) immediately.
  • Clamped prune_archive batch removal count to MAX_PRUNE_BATCH.
  • Clamped cursor advancements to total using saturating arithmetic.
• Registry Length & Safe Slicing (market_id_generator.rs):
  • Implemented get_market_id_registry_len(&Env) -> u32 for length inspection.
  • Added out-of-bounds cursor protection in get_market_id_registry.
• Paged State & Leaderboard Queries (queries.rs):
  • Sanitized limit across get_all_markets_paged, query_user_bets_paged, query_contract_state_paged, get_top_users_by_winnings, and get_top_users_by_win_rate.
  • Added cursor bounds checking and saturating arithmetic to prevent out-of-bounds slicing.
• Test Coverage:
  • Extended tests/archive_discoverability.rs with archive_queries_are_bounded_and_safely_paginated.
  • Added test_pagination_bounds_and_cursor_safety to queries.rs.

Stipulation Compliance Checklist

• Hard ceiling enforced on limit (MAX_QUERY_LIMIT = 30)
• Default page size applied when limit is 0 (DEFAULT_QUERY_LIMIT = 10)
• Pagination cursor bounds validated against storage size
• Pruning operations bounded (MAX_PRUNE_BATCH = 30)
• Zero mock assertions added; all tests run against actual Soroban host environment

Payout Routing

• EVM (Base/Arbitrum/Polygon/ETH): 0xF46C9F6d70C50BF81ef3588AB523a90a594a2F89
• Stellar: GCL6OXAMLD75BMTINA6EMRUDWK5THQUSHMYNLSNBCJAPZJHNYJTUNIBC