fix: reject set_personal_cap below lifetime_contribution (#441)

[CHKM001]

PR #441: Reject personal cap below lifetime_contribution

Problem

set_personal_cap_fn did not validate the new cap against the caller's existing lifetime_contribution. A contributor could set their cap to 1 stroop after contributing 1000 XLM, permanently blocking further contributions with no way to raise the cap again.

Fix

Added a validation check in set_personal_cap_fn (src/contributions.rs) that rejects any personal cap value below the caller's current lifetime_contribution:

let lifetime = get_lifetime_contribution(env, campaign_id, &contributor);
if amount < lifetime {
    return Err(Error::ValidationFailed);
}

Setting a cap equal to lifetime_contribution is intentionally allowed — it blocks future contributions without stranding anything, and the contributor can always set a higher cap later.

Tests

Two regression tests in src/tests/test_regressions.rs:

1. test_set_personal_cap_below_lifetime_contribution_rejected — contributes 1000, asserts cap=500 is rejected, cap=1000 is accepted, cap=2000 is accepted.
2. test_set_personal_cap_equal_lifetime_blocks_further_contributions — contributes 1000, sets cap to 1000 (equal to lifetime), asserts a subsequent contribution of 1 stroop is rejected with ContributionCapExceeded. This documents the boundary behavior as intentional.

Diff

 src/contributions.rs          |  4 ++++
 src/tests/test_regressions.rs | 61 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 65 insertions(+)

Closes #441

[davidmaronio]

thanks for the clean resubmission, this version is a proper 2 file diff and the guard plus boundary tests are correct. unfortunately #688 was opened earlier for the same fix (issue family #441/#457), has the same guard, and also updates the property test model in test_cap_interactions.rs so the proptest oracle stays in sync with set_personal_cap_fn, which this pr leaves stale. closing in favor of #688. happy to see you on another open issue.