security(contract): add two-step admin rotation with cancellation and expiry

[arisu6804]

Problem

Single-step administrator changes are vulnerable to mistakes, lost keys, or accidental transfer to an incorrect address.

Objective

Deliver a production-quality improvement to administrator management that creates measurable value for correctness, security, reliability, performance, or maintainability.

Implementation scope

• Add propose, accept, cancel, and expiry semantics for administrator rotation.
• Restrict each action to the correct current or pending authority.
• Emit events and prevent stale proposals from being accepted after expiry.

Acceptance criteria

• A new administrator cannot take control without explicit acceptance.
• The current administrator can cancel an unaccepted proposal.
• Expired proposals are rejected and leave the active administrator unchanged.

Required validation

• Authorization matrix, expiry, cancellation, replay, and event tests.
• Existing tests and CI remain passing.
• Add regression coverage for the original failure mode.
• Do not weaken, delete, or skip unrelated tests to obtain a green build.

PR quality bar

• Keep the PR focused on this issue and explain design tradeoffs.
• Include test evidence, compatibility impact, and migration or rollout notes where relevant.
• Avoid typo-only, documentation-only, cosmetic-only, or unrelated refactor submissions.

Out of scope

• Broad rewrites not required by the acceptance criteria.
• Changes to unrelated services, contracts, or user flows.