feat: add unauthorized caller tests for admin APIs

[Christopherdominic]

Summary

• add negative tests for admin-only APIs to verify unauthorized callers are rejected
• tighten stored-admin authorization checks for admin wrappers that previously accepted caller-supplied admin addresses
• document the updated admin authorization model and security assumptions

Testing

• cargo fmt --all
• cargo test test_admin -- --nocapture (blocked in sandbox: could not resolve static.crates.io to download time v0.3.41)

Security Notes

• admin-only wrappers now require an authenticated signature from the canonical stored admin before mutating state
• unauthorized calls are explicitly tested to ensure there is no silent fallback when a non-admin supplies the stored admin address
• rejection tests also confirm protected state remains unchanged after failed calls

Closes #581

[drips-wave]

@Christopherdominic Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Christopherdominic]

The failing Build checks are from other unimplemented issues in your project

[Baskarayelu]

Please resolve the conflicts