[vault-contract] Add constructor re-invocation protection

[Villarley]

Based on SECURITY_AUDIT_VAULT_CONTRACT-V1.0.0.md (finding F-10).

Severity: Medium

Summary

Add an initialization flag to prevent constructor re-invocation on upgrade/redeploy.

Acceptance criteria

• Add initialization flag (e.g. in storage)
• Panic if constructor is called when already initialized
• Document expected behavior on upgrades
• Tests pass