feat: add explicit admin role separation (#475)

[Magada06]

Summary

Closes #475 Enforces clear role boundaries between admin, proposer, and voter across both contracts.
Admin-only functions now reject unauthorized callers, admin ownership transfer follows a safe
two-step pattern, and all role changes emit on-chain events for auditability.

Changes

Governance contract

• transfer_admin(admin, new_admin) — step 1: current admin nominates a successor
• accept_admin(new_admin) — step 2: nominee must explicitly accept before the role transfers
• add_proposer(admin, proposer) / remove_proposer(admin, proposer) — admin-controlled allowlist
• create_proposal now rejects callers not on the proposer allowlist (NotProposer error)
• New errors: NoPendingAdmin, NotPendingAdmin, NotProposer
• New events: adm_init (transfer initiated), adm_done (transfer completed)

Token contract

• Same two-step transfer_admin / accept_admin pattern with events
• mint, transfer, burn now emit their respective events (pre-existing gap fixed)

Tests

38 tests passing (23 governance, 15 token), including:

• test_transfer_admin_two_step — happy path for both contracts
• test_transfer_admin_non_admin_reverts — non-admin cannot initiate transfer
• test_accept_admin_wrong_caller_reverts — wrong address cannot steal pending role
• test_create_proposal_non_proposer_reverts — un-allowlisted address cannot propose
• test_add_proposer_non_admin_reverts / test_remove_proposer_non_admin_reverts
• test_remove_proposer_revokes_access — removal is immediate and enforced

Acceptance Criteria

┌───────────┬────────┐
│ Criterion │ Status │
├────────────────────────────────────────────────────┼────────┤
│ Contracts distinguish admin, proposer, voter roles │ ✅ │
├────────────────────────────────────────────────────┼────────┤
│ Admin-only functions reject non-admin callers │ ✅ │
├────────────────────────────────────────────────────┼──────────────────────┤
│ Role transfer flow is safe and auditable │ ✅ two-step + events │
├────────────────────────────────────────────────────┼─────────────────────────┤
│ Tests cover unauthorized access │ ✅ 9 new negative tests │
└────────────────────────────────────────────────────┴─────────────────────────┘

[drips-wave]

@Magada06 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits