feat(vault): two-step admin handover via transfer_admin/accept_admin

[ibochielizabeth-spec]

closes #562

Summary

• Replaces set_admin's single-step, immediate admin transfer with the standard nominate/accept handover pattern: transfer_admin(new_admin) records a pending nominee under the current admin's signature, and a separate accept_admin() requires the nominee's own signature to complete the transfer.
• This closes off the "transferred to an address nobody can sign for" mistake class: admin never actually changes hands until the new key demonstrably proves it can sign, so a typo or an unreachable address can no longer permanently brick admin.
• set_admin is removed entirely (breaking change, as called out in the issue).

Changes

• packages/contracts/vault/src/lib.rs:
  • Added PEND_ADM instance storage key and ContractError::NoPendingAdmin (16).
  • Removed set_admin; added transfer_admin(new_admin) (admin-gated, sets the pending nominee, overwrites any prior unaccepted nomination), accept_admin() (nominee-gated via the nominee's own require_auth(), completes the transfer and clears the pending slot, fails NoPendingAdmin if nothing is pending), and get_pending_admin() -> Option<Address>.
  • Replaced/added tests: transfer_admin_then_accept_rotates_admin, accept_admin_fails_with_no_pending_nominee, transfer_admin_overwrites_a_prior_unaccepted_nomination, transfer_admin_fails_before_initialize (covers the full nominate → accept flow and rejects premature completion, per the issue's acceptance criteria).
• Docs updated to describe the new flow and drop set_admin references: apps/docs/architecture/vault-contract.md (interface, auth section, error table, storage table), apps/docs/operations/migration-keeper.md, apps/docs/operations/testnet-deployment.md, scripts/deploy-testnet.sh (comments only — its actual set_admin invocation there targets the mUSDC Stellar Asset Contract, a separate, unrelated set_admin, and is untouched).

Test plan

• cargo test --lib in packages/contracts/vault: all 58 tests pass, including the 4 new/updated ones.
• cargo build --workspace in packages/contracts: builds cleanly (blend-adapter, defindex-adapter, vault all compile against the updated interface).

[vercel]

@ibochielizabeth-spec is attempting to deploy a commit to the Collins' projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@ibochielizabeth-spec Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[collinsezedike]

Solid nominate/accept handover, correct auth model (accept_admin requires the nominee's own signature, not the current admin's), correct overwrite semantics, and I confirmed no off-chain caller references the vault's set_admin anywhere so nothing else breaks. Fixed the two docs' Prettier formatting directly and pushed. Merging now.