Lawyer says £145m Covid contract given to private company with Tory links ‘not lawful’