feat(token): add mint authority model to token program

Add an optional mint authority to fungible tokens for controlled supply:
create with a designated minter, mint additional supply, rotate the
authority to a new key, or permanently revoke it to fix the supply.

The authority is stored inline on `TokenDefinition::Fungible` as
`authority: Option<AccountId>` (`Some(id)` = mintable by `id`, `None` =
fixed supply). Keeping it a plain `Option<AccountId>` rather than a custom
wrapper type leaves account state decodable by `spel inspect`; the
require/rotate/revoke guard logic lives inline in the handlers.

LEZ rejects a transaction that lists the same account id twice, so one
instruction cannot statically express both "the definition account is the
authority and signs" (self/PDA authority) and "a distinct rotated account
signs" (external authority) — they need opposite signer markers. Each
privileged operation is therefore split into a self and an external
variant:

- `Mint` / `SetAuthority` — the definition account is the signer.
- `MintWithAuthority` / `SetAuthorityWithAuthority` — a distinct authority
  account is the signer; the definition account does not sign.

Creation via `NewFungibleDefinition { mint_authority, .. }`; an all-zero
authority id is rejected. The AMM's LP token uses self/PDA authority — its
stored authority is the LP definition PDA, minted only by the pool via
chained calls.

Covered by token unit tests and zkVM integration tests: creation with and
without an authority, self- and external-authority mint, rotation, and
external rotate/revoke. IDLs regenerated.

programs/amm/src/new_definition.rs

@@ -193,6 +193,7 @@ pub fn new_definition(
         &token_core::Instruction::NewFungibleDefinition {
             name: String::from("LP Token"),
             total_supply: MINIMUM_LIQUIDITY,
+            mint_authority: Some(pool_definition_lp.account_id),
         },
     )
     .with_pda_seeds(vec![
@@ -206,8 +207,10 @@ pub fn new_definition(
         name: String::from("LP Token"),
         total_supply: MINIMUM_LIQUIDITY,
         metadata_id: None,
+        // Self-authority: the LP token is mintable only by the pool, which
+        // presents this PDA as the authorized minter in the chained Mint call.
+        authority: Some(pool_definition_lp.account_id),
     });
-
     let call_token_lp_user = ChainedCall::new(
         token_program_id,
         vec![pool_lp_after_lock, user_holding_lp.clone()],

programs/amm/src/tests.rs

@@ -538,10 +538,11 @@ impl ChainedCallForTests {
 
         ChainedCall::new(
             TOKEN_PROGRAM_ID,
-            vec![pool_lp_auth, lp_lock_holding_auth],
+            vec![pool_lp_auth.clone(), lp_lock_holding_auth],
             &token_core::Instruction::NewFungibleDefinition {
                 name: String::from("LP Token"),
                 total_supply: MINIMUM_LIQUIDITY,
+                mint_authority: Some(pool_lp_auth.account_id),
             },
         )
         .with_pda_seeds(vec![
@@ -872,6 +873,7 @@ impl AccountWithMetadataForTests {
                     name: String::from("test"),
                     total_supply: BalanceForTests::lp_supply_init(),
                     metadata_id: None,
+                    authority: Some(IdForTests::token_lp_definition_id()),
                 }),
                 nonce: Nonce(0),
             },
@@ -897,6 +899,7 @@ impl AccountWithMetadataForTests {
                     name: String::from("LP Token"),
                     total_supply: MINIMUM_LIQUIDITY,
                     metadata_id: None,
+                    authority: Some(IdForTests::token_lp_definition_id()),
                 }),
                 nonce: Nonce(0),
             },
@@ -914,6 +917,7 @@ impl AccountWithMetadataForTests {
                     name: String::from("test"),
                     total_supply: BalanceForTests::lp_supply_init(),
                     metadata_id: None,
+                    authority: Some(IdForTests::token_lp_definition_id()),
                 }),
                 nonce: Nonce(0),
             },
@@ -3263,6 +3267,7 @@ fn test_new_definition_lp_symmetric_amounts() {
         &token_core::Instruction::NewFungibleDefinition {
             name: String::from("LP Token"),
             total_supply: MINIMUM_LIQUIDITY,
+            mint_authority: Some(pool_lp_auth.account_id),
         },
     )
     .with_pda_seeds(vec![
@@ -3365,6 +3370,7 @@ fn test_minimum_liquidity_lock_and_remove_all_user_lp() {
         &token_core::Instruction::NewFungibleDefinition {
             name: String::from("LP Token"),
             total_supply: MINIMUM_LIQUIDITY,
+            mint_authority: Some(pool_lp_auth.account_id),
         },
     )
     .with_pda_seeds(vec![