Fix unbounded early-termination refund (security)

[ParadauxIO]

Security fix — early lease termination refund could drain landlords

The bug

RealtyBackendImpl.unrentRegion computed the pro-rata refund as:

double refund = price * remainingSeconds / totalSeconds;

where remainingSeconds is now → endDate but totalSeconds is a single durationSeconds. renewLeasehold (MariaLeaseholdContractMapper) extends endDate by another durationSeconds per renewal without re-escrowing, and renewals are unlimited when maxExtensions is null. So a tenant could:

1. Rent a region for price,
2. Renew it N times (free),
3. unrent → refund price × N, debited from the landlord.

The ledger stays balanced (no minting), but it drains the landlord's real balance.

Observed in production (DemocracyCraft, 2026-06-14): a $150 rent refunded as $49,999.73; ~$294k moved from three landlords to two tenant accounts in ~20 minutes.

The fix

Clamp remainingSeconds to a single period (totalSeconds), so the refund can never exceed one period's price — the amount actually paid for the current term.

long remainingSeconds = Math.min(rawRemainingSeconds, totalSeconds);

Test

Adds a regression test (RealtyBackendImplTest.UnrentRefund): rent → renew ×5 → unrent must refund ≤ one period's price. Pre-fix this returned price × 6.

The realty-backend test suite is Testcontainers-based (needs Docker); it was compile-verified locally and runs fully in CI. The fix + test compile clean.

Follow-ups (not in this PR — separate decisions)

• Decide whether renewals should be charged, or whether free extension periods should count toward the refund at all.
• Enforce a sane default maxExtensions (no unlimited renewals).

Remediation (out of band)

The exploited balances still need reversing (claw back the two tenant accounts; restore the three landlords). Staff issued a partial fine already.