security: order route checks before effects

[webmirroring]

Summary

• Reorders compute_route_fee so registered-pair, amount bounds, liquidity sufficiency, and cooldown checks all pass before route state is written or events are emitted.
• Moves the reentrancy lock acquisition to immediately before the write/event phase, keeping rejected routes free of storage writes.
• Adds a regression test for a cooldown-blocked route that verifies PairLiquidity, pair route count, pair volume, last-route timestamp, liq_used events, and route events are unchanged.
• Documents the checks-before-effects guarantee in SECURITY.md.

Closes #128.

Security notes

The cooldown guard now runs in the read-only CHECKS phase, before liquidity debit, counter/timestamp updates, and liq_used / route emission. A route rejected by RouteCooldownActive does not leak observable route business effects.

Validation

• cargo fmt -- --check passes
• git diff --check passes
• cargo test test_cooldown_blocked_route_has_no_business_side_effects -- --nocapture is blocked locally before project compilation because the available Cargo is 1.84.0 and cannot parse base64ct v1.8.3's edition2024 manifest:

feature `edition2024` is required
The package requires the Cargo feature called `edition2024`, but that feature is not stabilized in this version of Cargo (1.84.0).