feat(escrow): two-step admin handover with pending acceptance

[Edoscoba]

Summary

• Adds propose_admin and accept_admin for two-step admin handover.
• Stores proposed successor in DataKey::PendingAdmin until the successor accepts.
• Keeps transfer_admin as a deprecated shim that only creates a pending proposal.
• Clears PendingAdmin after successful acceptance.
• Updates ADR/security/operator docs for the new auth boundary.

Security Notes

• Admin authority changes only after both current admin and proposed admin authorize.
• Self-proposal is rejected.
• Wrong pending admin can be overwritten by a new proposal before acceptance.
• Legal hold does not block handover, but remains active after acceptance.

Tests

• cargo fmt --check
• cargo check -p liquifact_escrow
• cargo clippy -p liquifact_escrow --all-targets -- -D warnings
• cargo test

Result: 332 passed; 0 failed; 14 ignored

close #246

[drips-wave]

@Edoscoba Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits