Implement admin rotation and recovery for milestones & maintenance-po…

[LawalRahman]

PR Title: Implement admin rotation & recovery for milestones and maintenance-pool; add tests, docs, and shared constants

Summary

• Adds admin/treasury rotation and an optional initialize-time recovery address to milestones and maintenance-pool.
• Centralizes shared constants into common.
• Adds end-to-end tests for rotation/recovery flows and fixes related test issues in escrow.
• Adds a short rationale document describing the recovery-address design and updates the access-control audit.

What changed (key files)

• Contracts
  • lib.rs
  • types.rs
  • test.rs
  • lib.rs
  • types.rs
  • test.rs
  • lib.rs (minor fixes)
  • test.rs (test fix)
  • lib.rs (shared constants)
• Docs & config
  • access-control-audit.md
  • recovery-address-justification.md (new)
  • .editorconfig

Why

• Addresses the "admin key permanently lost" scenario by providing a narrow, auditable recovery mechanism while preserving least privilege.
• Fixes an initializer access-control omission and unifies constants to reduce duplication.
• Ensures rotation and recovery flows are exercised by tests to prevent regressions.

Behavioral details

• initialize(..., recovery: Option<Address>): optional recovery address stored at initialize-time.
• set_admin(new_admin): admin-authorized rotation.
• recover_admin(new_admin): callable only by the configured recovery address to appoint a new admin if original admin is unavailable.
• set_treasury(new_treasury): admin-authorized.
• keep_alive, getters, and other permissionless flows unchanged where intentional.

Testing

• Ran full workspace tests:
  • Command:

    cargo test --workspace

  • Result: all tests pass locally.
• New tests cover rotation and recovery flows for milestones and maintenance-pool.

Notes for reviewers

• Review the recovery rationale in recovery-address-justification.md.
• Verify the initialize semantics and confirm set-once recovery is acceptable for your operational model.
• I kept the recovery permission narrowly scoped to recover_admin; it does not grant direct fund-moving rights.
• Escrow was changed only to align constants and fix a test; if you want symmetrical recovery in escrow, I can apply it in a follow-up PR (recommended only if operationally required).

Related issues

• Access-control audit and initializer front-run discussion: referenced in the updated audit doc.
• Consider follow-up: migrate to Soroban __constructor to eliminate initializer front-run window (tracked separately).

Checklist

• Tests: All tests pass: yes
• Docs: Access-control audit updated and recovery rationale added: yes
• CI: Please run CI (if different from local) to validate remote build.

If you want, I can:

• Open the PR on GitHub with this description and set reviewers/labels,
• Or, apply the same recovery pattern to escrow for full symmetry. Which would you prefer?

Closes #37
Closes #36
Closes #163
Closes #164

[drips-wave]

@LawalRahman Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

@LawalRahman is attempting to deploy a commit to the chonilius' projects Team on Vercel.

A member of the Team first needs to authorize it.