docs(security): add threat model for the bounty router contract (closes #156) - #192

Description

Adds docs/threat-model.md defining the threat model and trust assumptions for the deprader_router contract:

• Actors & Assets: Creators, researchers, admin, and adversaries; escrowed token balances and claim attribution integrity.
• Trust Assumptions: Admin role constraints, Soroban VM invariants, monotonic ledger timestamping.
• Threat Vectors & Mitigations:
  1. Claim squatting / front-running (multi-claim queue up to 50 claims, admin rejection).
  2. Admin key compromise (two-step rotation, release limited to existing claimant).
  3. Re-entrancy & token manipulation (strict CEI pattern, atomic transfers).
  4. Griefing via claim spam (single claim per address constraint).
  5. Indefinite fund lockup (7-day post-deadline review window auto-unlock).
  6. State archival / storage expiration (automated instance and persistent TTL extension).
  7. Reference string bloat (256-byte maximum length limit).
• Links related issues ([contract] Reject self-claims by the bounty creator #171, [contract] Minimum bounty amount per token #172, [contract] Add a get_config getter #173, [scanner] Agree on a standard issue_ref format for findings #162) and cross-references from README.md.

Closes #156

Tasks Completed

• Created docs/threat-model.md with actors, assets, trust assumptions, 7 threat vectors, and mitigations.
• Linked related issues ([contract] Reject self-claims by the bounty creator #171, [contract] Minimum bounty amount per token #172, [contract] Add a get_config getter #173, [scanner] Agree on a standard issue_ref format for findings #162).
• Linked the document under ## Documentation in README.md.
• Verified all commands, links, and markdown syntax.
• Added progress entry in PROGRESS.md.

Acceptance Criteria

• All commands and links in the new docs have been verified
• PROGRESS.md entry added, and the PR description includes Closes #156

Stellar Address (Stellar Wave Program)

GDLCJGQLXZGDAAT5QGRF6FM2MBEER3FPYGCSVPXYL47G2ABIOX2M2S6K