docs: add V2 audit reports and disclose router FoT behavior in comments

Bailsec differential (zero findings), HashDit (1 Low ack'd), CertiK
preliminary (8 pending). Router comments address CertiK LDV-06/07/08
disclosure recommendations; pair bytecode and init code hash unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: razww

audits/Bailsec-ListaV2-Differential-20260728.pdf

@@ -31,6 +31,9 @@ contract ListaV2Router02 is IListaV2Router02 {
     }
 
     // **** ADD LIQUIDITY ****
+    // amounts are quoted from pre-transfer reserves: adding a fee-on-transfer token to a
+    // non-empty pool over-contributes the paired token by the tax; the excess accrues to
+    // existing LPs. use a FoT-aware flow off-chain if that loss is unacceptable.
     function _addLiquidity(
         address tokenA,
         address tokenB,
@@ -187,6 +190,8 @@ contract ListaV2Router02 is IListaV2Router02 {
             address(this),
             deadline
         );
+        // sweeps the router's entire token balance: the post-tax amount received is unknowable
+        // in advance, and the router is never meant to hold tokens between transactions
         TransferHelper.safeTransfer(token, to, IERC20(token).balanceOf(address(this)));
         IWETH(WETH).withdraw(amountETH);
         TransferHelper.safeTransferETH(to, amountETH);
@@ -394,6 +399,7 @@ contract ListaV2Router02 is IListaV2Router02 {
             path[0], msg.sender, ListaV2Library.pairFor(factory, path[0], path[1]), amountIn
         );
         _swapSupportingFeeOnTransferTokens(path, address(this));
+        // pays out the router's entire WETH balance (router holds no funds between transactions)
         uint amountOut = IERC20(WETH).balanceOf(address(this));
         require(amountOut >= amountOutMin, 'ListaV2Router: INSUFFICIENT_OUTPUT_AMOUNT');
         IWETH(WETH).withdraw(amountOut);