[#453] Harden two-step admin handover

[Jagadeeshftw]

Summary

• reject self and current-admin successor proposals to prevent no-op and unrecoverable handovers
• emit an auditable cancellation event while clearing pending admin and ETA together
• add focused boundary, replacement, cancellation, and post-transfer tests
• document the timelock state machine, monitoring, rollback, and operator runbook

Acceptance criteria

• Propose/accept two-step transfer with ledger-timestamp timelock.
• Early, wrong-account, boundary, and cancellation paths are covered.
• Propose/accept/cancel lifecycle is observable through events.

Validation

• cargo test --lib admin_handover_tests (7 passed)
• rustfmt --edition 2021
• git diff --check
• 501 changed lines

Closes #453