feat(#106): implement real on-chain token.transfer() in sweep()

[Tyler7x]

Summary

Closes #106

Replaces the stub comment in sweep() with real on-chain token transfers using the Soroban token::TokenClient interface.

Changes

contracts/ephemeral_account/src/lib.rs

• Added token to the soroban_sdk import.
• In sweep(), after setting status to Swept (re-entrancy guard), iterate over all recorded payments and call:

  token::TokenClient::new(&env, &payment.asset)
      .transfer(&contract_address, &destination, &payment.amount);

• Updated sweep() rustdoc to describe the transfer behaviour.

contracts/ephemeral_account/src/test.rs

• Added test_sweep_executes_token_transfer: registers a Stellar asset contract, mints 500 tokens to the ephemeral contract, records the payment, calls sweep(), then asserts the contract balance is 0 and the destination balance is 500.

Notes

• Status is set to Swept before the token calls to prevent re-entrancy — consistent with checks-effects-interactions.
• Existing tests that use a non-token asset address still pass because mock_all_auths() intercepts the token calls without requiring a real contract.

Testing

cargo test -p ephemeral_account

[drips-wave]

@Tyler7x Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[phertyameen]

@Tyler7x resolve conflict please

[Tyler7x]

@phertyameen resolved