fix: correct auditor-key claims in THREAT_MODEL.md and circuit comments

[tech-adrian]

Summary

#133's threat model listed "auditor scoping" as an enforced property of the compliance and disclosure circuits, and both circuits carried a comment claiming a Poseidon2 hash provides that binding. Neither claim was accurate as stated:

• The hash (_disclosure_commitment / _binding) is never asserted against anything — it's dead code. I verified removing it changes the compiled bytecode (auditor_key becomes an unused parameter and the artifact hash changes), so it stays in place rather than being deleted. Only the comment claiming it does cryptographic work was wrong.
• The real anti-redirect property — a proof can't be silently retargeted to a different auditor_key after generation — comes from auditor_key being a pub argument to main. Any public input is bound into what the proof verifies against; that's independent of this specific hash.
• Neither the circuit nor the compliance contract checks that auditor_key corresponds to a real, registered auditor. There's no auditor registry anywhere in contracts/compliance/src/lib.rs; a prover may set it to any Field value.

Changes

• circuits/compliance/src/main.nr, circuits/disclosure/src/main.nr: corrected comments to state the actual mechanism; renamed the dead value from _disclosure_commitment/_binding to _auditor_key_referenced so it doesn't imply a security property it doesn't have.
• docs/THREAT_MODEL.md:
  • New "Auditor-key binding" section explaining what's actually enforced vs. assumed.
  • Moved the registry gap from the enforced-properties column into External assumptions for both circuit rows (matching the doc's existing pattern for other unenforced properties).
  • Added a bullet under Residual assumptions pointing at bug(critical): deposit note secrets can be permanently lost if the tab closes before confirmation #63 — the existing "users protect their own secrets" line glossed over a real app-level bug where a closed tab during deposit confirmation can strand a note with no recoverable secret.

Validation

• bb write_vk against the recompiled bytecode for both circuits produces byte-identical VKs to the currently-committed ones — confirmed by diffing the regenerated vk files against circuits/{compliance,disclosure}/target/vk. This is a comment/doc-only fix cryptographically; no proof fixtures, deployed VKs, or frontend circuit artifacts need to change.
• cargo test --workspace: 145 passed, 0 failed.
• pnpm test: 140 passed, 0 failed.

Test plan

• Both circuits compile cleanly
• VK bytes unchanged (diffed against committed artifacts)
• Contract test suite passes unchanged
• Frontend test suite passes unchanged