[vault-contract] Fix arithmetic overflow in claim formula

[Villarley]

Based on SECURITY_AUDIT_VAULT_CONTRACT-V1.0.0.md (finding F-02).

Severity: Critical

Summary

Use checked_mul and checked_div in the formula token_balance * (100 + roi_percentage) / 100 (lines 171 and 303).

Acceptance criteria

• Add ArithmeticOverflow variant to ContractError
• Replace unverified arithmetic with checked_mul and checked_div in claim and preview_claim
• Validate roi_percentage range in constructor (e.g. 0–1000)
• Tests pass
• Scout no longer reports overflow at lines 171, 303