Missing initializer protection enables potential initialization hijacking

This issue was raised during the mitigation period while reviewing F-2025-0007.

The upgradeable StakingContract implementation is missing the _disableInitializers() call in its constructor.

When using the transparent proxy pattern with OpenZeppelin's upgradeable contracts, the implementation contract should have its initializers disabled to prevent attackers from directly initialising the implementation contract (not the proxy).

Without this protection, an attacker could potentially:

1. Call initialize() directly on the implementation contract.
2. Set themselves as the owner of the implementation.
3. Potentially cause confusion or interfere with proxy operations.

Add a constructor that disables initializers:

/// @custom:oz-upgrades-unsafe-allow constructor
constructor() {
    _disableInitializers();
}

Ample Protocol: Fixed.

Zealynx: Verified.