feat: audit pause unpause access control

[Buchi-Einstein]

Description

Audit pause/unpause access control across all three canonical contracts. Fix missing require_not_paused checks, add missing event emissions, and add comprehensive test coverage.

Audit Checklist

Invoice Contract (COMEBACKHERE-contracts/contracts/invoice/src/lib.rs)

Entrypoint	Has pause check	Events
initialize	N/A	—
create_invoice	✅	✅
mark_paids	✅	✅
cancel_invoiced	✅	✅
request_refund	✅	✅
release_escrow	✅	✅
batch_expire	✅	✅
set_treasury	❌→✅ FIXED	—
raise_dispute	✅	✅
pause	✅ admin check	✅
unpause	✅ admin check	✅
set_grace_window	✅	—

Treasury Contract (COMEBACKHERE-contracts/contracts/treasury/src/lib.rs)

Entrypoint	Has pause check	Events
set_signer	✅	—
propose_settlement	✅	—
approve_settlement	✅	—
execute_settlement	✅	—
update_threshold	✅	✅
raise_dispute	✅	—
resolve_dispute	✅	—
deposit	✅	—
withdraw	✅	—
add_token_to_allowlist	✅	—
remove_token_from_allowlist	✅	—
pause	✅ admin check	❌→✅ FIXED
unpause	✅ admin check	❌→✅ FIXED

Compliance Contract (COMEBACKHERE-contracts/contracts/compliance/src/lib.rs)

Entrypoint	Has pause check	Events
allow_address	✅	✅
block_address	✅	✅
allow_address_until	✅	✅
clear_address	✅	✅
transfer_admin	✅	—
accept_admin	❌→✅ FIXED	—
pause	✅ admin check	❌→✅ FIXED
unpause	✅ admin check	❌→✅ FIXED

Changes

1. Invoice: Added check_not_paused to set_treasury
2. Treasury: Added contract_paused/contract_unpaused events to pause/unpause
3. Compliance: Added check_not_paused to accept_admin, converted pause/unpause to return Result with admin check and events
4. Tests: Added per-contract tests for every mutating entrypoint being blocked while paused, read-only entrypoints working while paused, pause/unpause event emission, and unauthorized pause/unpause rejection

Security

This is a security-sensitive change. Missing pause checks allowed state mutations while the contract was paused. Missing events made pause state changes untraceable on-chain.

Closes #184

[drips-wave]

@Buchi-Einstein Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits