finance/order-book: make the base, quote, and fee vaults market PDAs

[mikemaccana]

initialize_market created the three vaults at public keys the client generated, so opening a market meant generating and signing with three extra keys, and nothing but the market's record said where its tokens were. The vaults are now PDAs of the market, with the market as their authority. That is the shape the options and prop AMM vaults already have.

Vault	Seeds
base vault	["base_vault", market]
quote vault	["quote_vault", market]
fee vault	["fee_vault", market]

What stays the same

• The market still records each vault address. Every other handler still checks the vaults it is passed against that record, so the test that passes the fee vault in place of the quote vault still gets rejected.
• The order book stays client-allocated. At about 180 KB it is too large for the program to create.

Scope

• Anchor v2 and Quasar ports: seed constants beside MARKET_SEED (Quasar gets a #[derive(Seeds)] type per vault), and a seeds constraint on each vault's init.
• Tests derive the vaults instead of generating keys for them, and the vault keys drop out of every signer list.
• READMEs and changelogs follow, including the root changelog.
• The Anchor v1 port is a frozen snapshot and does not change, per CONTRIBUTING.md and the most recent changelog entry.

CI

Main's Anchor v2 runs were red because surfpool 1.6 won't start without an IDL, and order-book is built with --no-idl. #149 fixed that on main, and main is merged in here, so this PR no longer touches the workflow.

Verified locally

• Anchor v2: cargo build-sbf, then cargo test. All 27 tests pass. They can only pass against the new program, because the old one required the three vault keys to sign.
• anchor test --no-idl --skip-local-validator also passes, 27/27, which is what CI runs.
• Quasar: quasar build, then cargo test. All 6 tests pass.
• cargo fmt --check is clean in both ports.
• cargo clippy --all-targets -D warnings fails with two lints (div_ceil, is_multiple_of) in the Anchor test file, in code this change doesn't touch. They fail identically on main.

This is the companion change for the book's order-book figures in quicknode/solana-book#149, which will draw the vaults as derived addresses beside their seeds.

🤖 Generated with Claude Code

https://claude.ai/code/session_011VUvZT5384GaSBhhgJwFp3

[mikemaccana]

Anchor v2 / build-and-test-group-0 is red for a reason that isn't this PR's. Main fails the same way: the push run for #140 fails on finance/betting-market/anchor (run 35791353050), and so does the 09-21 scheduled run.

Cause. The workflow installs surfpool from latest, which is now 1.6.0. Surfpool 1.6.0's generated deployment runbook calls svm::get_program_from_anchor_project, and that call reads target/idl/<program>.json. The nine projects on the anchor#4947 list are built with --no-idl, so that file never exists and surfpool refuses to start before any test runs. Reproduced locally with anchor-cli 2.0.0-rc.1 and surfpool 1.6.0:

error: 'svm:deploy_program' command 'deploy_order_book': function 'svm::get_program_from_anchor_project':
  invalid anchor idl location ./target/idl/order_book.json: No such file or directory (os error 2)
Error: Surfpool startup failed: Runbook execution failed

Proposed fix. All nine --no-idl projects set test = "cargo test", which runs LiteSVM and never talks to a validator. So anchor test can skip starting one for exactly those projects, in .github/workflows/anchor.yml:

       echo "::notice::skipping IDL generation for $project (anchor#4947)"
-      idl_flag="--no-idl"
+      # These run LiteSVM tests (`test = "cargo test"`), so they need no validator,
+      # and surfpool >= 1.6 will not start without the IDL this skips.
+      idl_flag="--no-idl"
+      test_flag="--skip-local-validator"
       ;;
     *)
       idl_flag=""
+      test_flag=""
       ;;
 ...
-  if ! anchor test $idl_flag; then
+  if ! anchor test $idl_flag $test_flag; then

With that change, anchor test --no-idl --skip-local-validator passes locally for order-book: 27/27. There is no open PR with this fix, and I've kept it out of this one so the diff stays about the vaults. The Quasar, Rust, and lint checks are green. The order-book tests pass locally: Anchor v2 27/27, Quasar 6/6.

---

Generated by Claude Code