Expired reward pool close can refund economically accrued borrower yield before lazy reward materialization

Double subtraction of `cash_reserve` bypasses the deposit cap, allowing attackers to siphon active liquidity mining rewards from full markets