refactor(upgrade): enforce auth and state preconditions before WASM upgrade (#352)

[Awosdot]

Summary of Changes

• Guard Clause Reordering: Refactored the upgrade entrypoint to execute caller authorization (admin.require_auth()) and contract state precondition checks prior to reading or mutating any storage entries or executing WASM updates.
• Gas & Storage Integrity: Ensured early exit with appropriate typed errors on failure (e.g., unauthorized caller or paused/invalid contract state) while guaranteeing zero ledger storage mutations occur.
• Unit Testing: Added comprehensive test coverage asserting proper typed error returns for unauthorized/illegal state calls and verifying state non-mutation.

Closes #352

[drips-wave]

@Awosdot Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits