[#547] Harden oracle median and freshness validation

[greatest0fallt1me]

Summary

• retain source-specific observations and require an admin-configurable fresh quorum
• calculate deterministic medians after checked decimal normalization
• reject stale/future observations, unsupported precision, duplicate metadata, and arithmetic overflow
• preserve legacy latest-price reads for assets that have not opted into source metadata
• add a comprehensive Soroban regression suite and operational policy documentation

Acceptance criteria

• Insufficient or stale observations fail closed instead of silently falling back.
• Decimal conversion, median midpoint, and scaling are overflow-safe.
• Duplicate source updates replace one source observation; corrupted duplicate metadata and unauthorized writers fail deterministically.
• Tests cover outliers, equal values, timestamp boundaries, quorum failures, decimal conversion, and overflow.
• Documentation covers trust assumptions, configuration, migration, failure modes, and incident response.

Design notes

Each source has one observation per asset. get_price_valid aggregates source metadata when present, requiring the configured quorum of whitelisted and fresh sources. Values are normalized to the highest observed precision and insertion-sorted without relying on Address ordering. The even-count midpoint uses a difference-first calculation to avoid overflowing on large prices, and the result timestamp is the oldest accepted observation.

Verification

• git diff --check passes.
• cargo test -p price_oracle was attempted but is currently blocked before test compilation by the repository dependency ethnum v1.5.2 using an invalid zero-sized transmute with rustc 1.97.1.
• The new regression suite uses the generated contract client and Soroban test environment and is ready for CI/toolchain validation.

Compatibility

Existing single-source deployments continue to work with the default quorum of one. Existing assets with only legacy Price(asset) storage remain readable until source metadata is published. Once source metadata exists, quorum failure does not fall back to the legacy snapshot.

Closes #547