feat(admin): config epoch serialization and retry contract for privileged operations

[nasirudeenbadirudeen87-cloud]

Description

Implements the concurrency / race-safety contract for the Admin contract's privileged configuration, pause, and ownership operations (issue #1297).

• Monotonic ConfigEpoch: every committed privileged mutation advances the counter exactly once (add_admin, remove_admin, update_admin_role, deactivate_admin, reactivate_admin, suspend_admin, transfer_ownership, accept_ownership, set_pause_signer, set_pause_threshold, pause, unpause, approve_pause_proposal, execute_pause_proposal).
• New read entrypoint get_config_epoch(): clients read it alongside the governance state they depend on, detect concurrent conflicts (epoch advanced), and retry against fresh state. The client retry contract is explicit in the module docs and docs/CONFIG_EPOCH.md.
• Atomicity: rejected, stale, repeated, and failed operations never advance the epoch and never leave partial state behind (Soroban atomic rollback).
• Idempotency hardening: same-role update_admin_role, duplicate pause/unpause, duplicate proposal approvals, and re-proposing an already-proposed-and-approved action are now no-ops — no state change, no events, no epoch bump.
• Conflict behavior: conflicting multi-step flows serialize by last-writer-wins (e.g. two ownership transfers); the superseded flow can never complete.

Regression coverage

contracts/admin/src/test_concurrency_race_safety.rs (7 tests) locks the invariant at the integration boundary (generated contract client): exactly-once epoch advancement per committed mutation, auth-rejection atomicity, insufficient-approval atomicity (proposal stays live), idempotent repeats, conflict detection + retry, last-writer-wins ownership transfer, and paused-rejection atomicity.

Closes #1297

Type of Change

• feat — new functionality
• fix — bug fix
• docs — documentation only
• refactor — code restructuring with no behaviour change
• test — test additions or improvements
• ci — CI configuration changes
• chore — maintenance, dependencies, tooling

How Has This Been Tested?

• cargo fmt clean on all touched files
• cargo test -p admin — blocked locally: this machine lacks Xcode Command Line Tools (/Library/Developer/CommandLineTools missing), so Cargo cannot link build scripts (serde/proc-macro2). CI (contract workflow: fmt, clippy -D warnings, cargo test) runs on the PR; I can fix anything CI flags.
• Manual review of the diff

Checklist

• Tests added/updated for new or changed functionality
• Docs updated (public API and architecture — new get_config_epoch entrypoint, docs/CONFIG_EPOCH.md, module docs)
• CHANGELOG.md updated (contracts/** touched)
• Branch follows fix/issue-1297 naming convention
• Commit messages follow conventional commits

[drips-wave]

@nasirudeenbadirudeen87-cloud Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits