feat: implement two-step admin transfer in loyalty_token

[mftee]

Summary

Implements a two-step admin transfer in loyalty_token to prevent irreversible lockout from a typo in the new admin address.

Changes

• DataKey: Added PendingAdmin variant
• transfer_admin: Now only sets DataKey::PendingAdmin and emits (admin, proposed) — does NOT change the active admin
• accept_admin: New function — caller must equal PendingAdmin, promotes to Admin, clears PendingAdmin, emits (admin, accepted)
• cancel_transfer: New function — current admin can cancel a pending transfer, clears PendingAdmin

Tests

• transfer_admin alone does not change the active admin
• Happy path: propose -> accept -> old admin can no longer mint
• accept_admin from wrong address panics with "not pending admin"
• Cancel path: propose -> cancel -> PendingAdmin cleared, old admin still active
• accept_admin after cancel panics

Closes #280

[Leothosine]

Thanks for your contribution