feat(tokens): enforce per-account state limits [b#037]

[Jerry-Tekh]

Summary

• add bounded per-account limits for bets, positions, and subscriptions
• require authentication for all state-changing entrypoints
• add focused boundary, authorization, overflow, and state-integrity tests
• document the token limits API and hard maximum

Verification

• 18 focused tests passed
• cargo clippy --offline --locked --all-targets -- -D warnings
• cargo fmt --package tokens -- --check

Closes #1127

[drips-wave]

@Jerry-Tekh Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[greatest0fallt1me]

Nice one — clean, focused change. Merging. 🚀