feat: add pending admin remaining time view

[webmirroring]

Closes #552

Summary

• Added get_pending_admin_remaining_secs() -> Option<u64> as a pure read view for pending admin handover validity.
• Kept boundary parity with accept_admin: now == expiry returns Some(0) while still acceptable, and now > expiry returns Some(0) while accept_admin rejects.
• Added focused admin tests for no proposal, positive remaining time, exact-expiry acceptance, post-expiry rejection, and far-future saturating expiry.
• Documented the view in the README, operator runbook, and escrow read API reference.

Security notes

• The new view is read-only: no auth, no storage writes, no TTL bump.
• It reads PendingAdmin before reporting any remaining time so inactive handovers return None.
• Remaining seconds use saturating_sub to avoid underflow after expiry.

Validation

• PASS: git diff --check
• BLOCKED locally: cargo test -p liquifact_escrow pending_admin_remaining -- --nocapture
  • Local toolchain is cargo 1.84.0 / rustc 1.84.0.
  • Dependency resolution fails before compiling tests because base64ct v1.8.3 requires Cargo's stabilized edition2024 support from newer Cargo.
• BLOCKED by existing formatting drift: cargo fmt -p liquifact_escrow -- --check
  • This reports pre-existing formatting diffs in unrelated files/lines such as escrow/src/tests/funding.rs, integration_status_guards.rs, properties.rs, and existing lines in escrow/src/lib.rs.