feat(erc4626): use injected OAV input token for approvals - #35

Summary

• Add optional allocatorVaultInputTokenAddress on FeeConfiguration (types + JSON schema) and read it in the ERC-4626 validator.
• Injected-OAV APPROVAL uses that token (including when it differs from the yield's base vault). Address-only injection still allows SUPPLY/WITHDRAW and no longer infers the parent token for APPROVAL.
• Replace getBaseVaultForChain with synthesizeInjectedVault. Static vaultInfoMap lookup is unchanged.
• @yieldxyz/shield stays at 1.7.0 on this branch (no version bump in this PR).

QA Proof

• ERC-4626 unit tests: 140 passed (pnpm test -- erc4626.validator.test), including the context-injected allocator vaults (runtime OAV) suite. Screenshot attached.
• Schema accept: handleJsonRequest with the new context field on a Lido stake tx returns ok: true (Lido ignores the ERC-4626 fields; the point is that the request is not SCHEMA_VALIDATION_ERROR):

{"ok":true,"apiVersion":"1.0","result":{"isValid":true,"detectedType":"STAKE"},"meta":{"requestHash":"259aec5a7b4ead52feff152073b8ea28fd9e9ccbd66b140cd5b57a9b41aa0ff5"}}

• Full pnpm test reported 6122 passing assertions. The run exited non-zero because the Tron Jest worker crashed on circular req/res serialization — native-staking.validator.test.ts failed to run, not on an assertion. Unrelated to this change.

What Needs to Be QA'd in Staging

• Injected OAV approval succeeds only when allocatorVaultInputTokenAddress matches tx.to
• Injected OAV supply/withdraw still succeed with address-only feeConfiguration (no input-token field)
• Static-registry allocator approval/supply unchanged when context is omitted
• Meta-vault: injected token != parent vault input token still validates
• Clients still on Day 1 address-only injection: APPROVAL of the parent token to an injected OAV is now blocked until they send the new field
• Note: production ShieldValidationService does not populate context yet, so staging cannot fully exercise injected OAVs until that monorepo wiring lands. The Shield-side contract for this PR is the unit + schema checks above.

QA Team Notification

• QA team has been notified to test in staging