fix(subscription): require admin auth on init

[priscaenoch]

Summary

closes #1376

MyfansContract::init() stored the supplied admin address with no signature verification at all — any caller could initialize the contract and name themselves (or anyone else) admin, since only the "already initialized" state was checked.

• init() now calls admin.require_auth() immediately after the already-initialized guard and before any other validation/storage writes, so only the address that will become the stored admin can perform initialization.
• Updated contract/AUTH_MATRIX.md's subscription init row: signer requirement changed from none to admin, with matching valid/invalid invocation examples.
• Updated contract/contracts/subscription/README.md to document that init requires admin authorization.
• Added test_init_requires_admin_auth_without_persisting_state (in src/test.rs), mirroring the existing, identical pattern already used for the earnings contract's init: an unauthorized attempt is rejected and leaves the contract uninitialized, then a properly authorized init succeeds.
• Added sub_init_invalid_non_admin_rejected to the AUTH_MATRIX.md compliance suite (tests/auth_matrix.rs), and renamed sub_init_valid_any_caller to sub_init_valid_admin_signs to reflect the new requirement (all existing callers of this test already mock all auths, so its assertions are unaffected).

All other existing init tests (test_init_succeeds_sets_admin_and_configuration, test_init_rejects_*, property tests, contract_integration.rs, etc.) already call env.mock_all_auths() in their setup, so they are unaffected by this change.

Testing/validation performed

• Manual review of every call site that invokes MyfansContract::init across src/test.rs, tests/auth_matrix.rs, tests/contract_integration.rs, and src/property_tests.rs to confirm each already runs under mock_all_auths() and will not break.
• Note: this sandbox has no Rust toolchain available, so I could not run cargo test -p subscription, cargo fmt --check, or the wasm build locally. Please confirm CI (cargo test -p subscription) passes before merging.

Issue

#1376

[drips-wave]

@priscaenoch Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits