Add payroll refund authorization boundaries

[edehvictor]

Summary

Add explicit refund rules for cancelled, expired, disputed, and settled payroll runs so reserved funds can be returned safely without enabling hidden clawbacks.

Why This Matters

Refund logic sits close to employee trust. The contract must distinguish safe treasury release from dangerous post-settlement reversal behavior.

Suggested Files

• contracts/src/refunds.rs
• contracts/src/treasury.rs
• contracts/src/payroll.rs
• contracts/tests/refund_boundaries.rs

Tasks

• Define refund eligibility by payroll lifecycle state.
• Allow refunds only for cancelled or expired unexecuted reservations.
• Block refunds after settlement finalization.
• Require dispute resolution before refunding disputed reservations.
• Add tests for every lifecycle state.

Acceptance Criteria

• Unexecuted cancelled or expired reservations can be refunded safely.
• Settled payroll funds cannot be clawed back through refund APIs.
• Disputed runs require resolution before refund release.
• Tests cover cancelled, expired, disputed, executing, and settled states.

Coordination

Join the Telegram channel for proper coordination: https://t.me/zkpayroll

[nomsoscript]

Hi maintainers!
I’d love to help out with this issue. I’ve checked the current codebase/documentation and know exactly what needs to be updated to make this clearer. I will ensure everything aligns perfectly with your existing contribution guidelines.