fix(field): require caller ownership and cancel listings on combinePlots

[fr1jo]

Summary

• Add authorization check: caller must own the plots being combined
• Cancel any existing pod listings before deleting combined plots
• Remove permissionless access comment from natspec

Context

During security review of PI-15, identified that combinePlots() was permissionless and could leave orphaned marketplace listings:

1. Permissionless issue: Any account could combine any other account's plots, which while not stealing funds, modifies user state without consent
2. Orphaned listings: If a plot had an active marketplace listing and was combined away (not the first plot), the listing would remain in storage but become unfillable

Changes

// Added authorization
require(LibTractor._user() == account, "Field: Caller must own plots");

// Cancel listing before deleting plot
if (s.sys.podListings[fieldId][plotIndexes[i]] != bytes32(0)) {
    LibMarket._cancelPodListing(account, fieldId, plotIndexes[i]);
}

Test plan

• Verify existing combinePlots tests still pass
• Add test for unauthorized caller rejection
• Add test for listing cancellation on combine

🤖 Generated with Claude Code