fix(token): require token existence in NonFungibleToken _approve - #824

Audit finding M-04 (Midnight Foundation #2, release 0.3.0-alpha.1).
`_approve` ran its approver validation only when `auth` was non-zero, so
the `_requireOwned` existence check sat inside the guarded branch while
the approval write executed outside it. The zero-auth path therefore
recorded approvals for tokens that were never minted.

Solidity's reference does not have that gap. Its composer-facing
`_approve(to, tokenId, auth)` delegates to
`_approve(to, tokenId, auth, true)`, whose guard is
`emitEvent || auth != address(0)` and so always reads the owner. The
port kept only the `auth` half of the disjunct, giving one circuit the
name of the safe overload and the behaviour of the unchecked one.

Restore the split the same way Solidity overloads it:

* `_approve` always requires existence and delegates to `_unsafeApprove`
* `_unsafeApprove` takes `isExistenceRequired`, mirroring `emitEvent`;
  Compact has no events, so the flag carries the existence check alone
* `_update` clears through `_unsafeApprove(.., false)`, the one call
  site Solidity also routes to the unchecked overload
* fold the approver check into a single assert, matching Solidity's
  `auth != 0 && owner != auth && !isApprovedForAll(..)` revert condition

Add a second barrier so a composer misusing the unchecked variant cannot
turn a planted approval into an unauthorized mint: `_unsafeTransferFrom`
now asserts the previous owner is non-zero, the same check and message
`_unsafeTransfer` already carries.

`_checkAuthorized` is left as is. It matches the Solidity reference line
for line, and with the above in place its ordering is unreachable.

Tests: the three M-04 reproductions now pass, plus a `_unsafeApprove`
suite covering both flag values, the approver check, the uninitialized
path, and the planted-approval transfer that the new assert rejects.

Row counts re-measured across the module; `_transfer` and
`_unsafeTransfer` drop from k=12 to k=11.

Review feedback: drop the `audit M-04` describe block and the
before/after-fix narration. The three regression tests move into the
existing `_approve` block with self-describing names, and the comments
that survive describe current behaviour only.

Traceability for the finding stays in the fix commit and the PR body.

The `_approve` version planted nothing once existence became a
requirement, and it asserted the approval was absent. `_unsafeApprove`
with `isExistenceRequired: false` records it for real, so the test now
pins the actual behaviour: `_update` clears approvals only for a non-zero
source, so a mint leaves a pre-planted approval standing.