feat: prepare smart contracts for formal security audit

[Edoscoba]

Summary

• Added formal audit prep docs covering contract scope, trust assumptions, admin key management, upgrade authority, scan results, and third-party audit checklist.
• Added audit-ready README files for each deployable smart contract.
• Hardened contract code for admin authorization, checked arithmetic, milestone bounds, and state-before-transfer ordering.
• Updated vulnerable transitive dependencies in Cargo.lock.

Verification

• cargo test --workspace passed: 220 passed, 0 failed, 10 ignored.
• cargo clippy --workspace --all-targets passed with non-blocking test/mock warnings.
• cargo-audit audit --no-fetch --stale passed with 0 vulnerabilities.

closes #591

[drips-wave]

@Edoscoba Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Anuoluwapo25]

kindly fix conflicts