Make zone IDs deterministic

[decofe]

Summary

• derive zone IDs from admin and salt instead of factory order
• keep delegated deployment via admin authorization signatures bound to the caller and full create payload
• update docs, scripts, bindings, and tests for salt/signature flow

Tests

• forge test --match-contract ZoneFactoryTest
• cargo check -p tempo-zone-contracts
• cargo check -p tempo-xtask

Prompted by: @grandizzy