DxSale Legacy Locker Repeat Unlock Drain

The legacy `unlockToken(uint256)` path transferred LP balances without consuming the recorded lock amount, so the same lock entry could be withdrawn hundreds of times until locker balances were depleted; an ownership handoff to an attacker-controlled wallet enabled the setup and execution flow.