feat(contract): add rate limiting, dead man's switch, and packed state (#714)

[billcode124]

Implements the struct packing requested in #714, and brings the contract up to
date with the #716 rate limiter and the dead man's switch.

Note on scope: the struct packing in #714 could not land on its own. The
largest win (the RateLimitCounter repack) only exists because the rate
limiter stores that record, so this necessarily bundles the rate limiter and
the dead man's switch with the packing work. The Horizon polling backend work
that was sitting on this branch has been removed and is not part of this PR.

Also worth reviewing on its own: the route_payment auth fix below is a
security fix and may deserve a faster path than this PR.

Security fix

route_payment had lost its sender.require_auth(), meaning anyone could route
funds out of any address. Validation now runs before auth — preserving the
rollback-panic fix from b849e9a, since a require_auth abort rolls back the
whole invocation and would turn ordinary validation errors into an opaque host
panic — and auth is enforced again.

#714 struct packing

Applied to the two records that actually reach the ledger:

Record	Before	After
DataKey::RateLimitCounter	BytesN<24>	BytesN<8> (two u32s)
pausable_token Allowance	contracttype struct	BytesN<20>

• RateLimitCounter: 24 → 8 bytes. It reused the BytesN<24> UserSpending
  layout from Optimize contract storage by compressing user spending history #519 (u64 window + i128 count) even though neither field needs
  that width. The window marker is a ledger sequence, which
  Env::ledger().sequence() already returns as u32, and the counter is bounded
  by a u32 RateLimitConfig. A 67% reduction on one persistent entry per
  active sender.
• Allowance → BytesN<20> (i128 amount + u32 expiry), dropping the XDR
  struct discriminant and per-field map framing from one persistent entry per
  (owner, spender) pair. Allowance remains a #[contracttype] because
  allowance() returns it to callers and it appears in the generated bindings.

Payment and UserSpending are deliberately untouched: neither is persisted
(so packing them would only shrink calldata, not the ledger), and
UserSpending was already packed by #519.

Serialization robustness

Packing is only safe if lossless, so the round trips are pinned by tests rather
than trusted: exact byte width, the full u32 and i128 ranges including
i128::MIN, field independence (a max-width field must not corrupt its
neighbour), big-endian layout asserted on raw bytes, and a test reading the
value back off the ledger to confirm the write path stores the packed form.

Rate limiting (#716)

check_rate_limit is enforced on both route_payment and route_payments — one
invocation slot per payment, charged after auth so only authorized senders are
counted, with whitelisted senders bypassing it. The window is keyed on the ledger
sequence, so it rolls over when the next ledger seals with no time bookkeeping.

Worth being explicit about the limit of this control: it can only bound
successful payments. A contract function returning Err has its entire
invocation rolled back by the host, counter included, so a rejected attempt costs
the spammer the transaction fee but leaves no state behind. It must not be relied
on to throttle failing traffic.

Dead man's switch

set_backup_admin_internal / remove_backup_admin / claim_admin / ping. A
backup admin can claim admin rights once the primary has been silent for the
configured timeout. Deliberately neither timelocked nor blocked by a contract
freeze: if the primary admin is gone there is nobody left to execute the queue,
and a freeze must not be able to brick recovery. Routing a payment also counts as
a heartbeat.

Incidental fixes

• pausable_token did not compile at all. It lacked the [patch.crates-io]
  ethnum override that payment_router already carries, so stock ethnum 1.5.0
  failed with E0512 on a mem::transmute in error.rs. The crate is in
  neither CI nor the Dockerfile, which is why this went unnoticed.
• .husky/pre-commit called npx lint-staged, which intermittently fails
  with No matching version found for undefined@lint-staged when it consults the
  registry instead of the local install. Now calls the binary directly. The hook
  was also checked in with CRLF endings, which made if ...; then\r a syntax
  error; .gitattributes only covered *.sh, never the extensionless hooks.
• eslint.config.mjs: the root lint run aborted with ERR_MODULE_NOT_FOUND
  because ESLint discovered payment-dashboard/eslint.config.js and could not
  resolve that config's plugins. Excludes subprojects that are linted separately.
• Regenerated packages/types for the new ABI.

Verification

• payment_router: 74 passed / 0 failed
• pausable_token: 24 passed / 0 failed
• cargo clippy --all-targets --all-features -- -D warnings clean on both
• cargo build --target wasm32-unknown-unknown --release succeeds

Closes #714

[vercel]

@billcode124 is attempting to deploy a commit to the Abdulazeem's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@billcode124 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Abdulazeem-code]

Resolve conflict And fix failed checks

[Abdulazeem-code]

Fix failed check amd resolve conflicts

[Abdulazeem-code]

Kindly Resolve conflicts

[Abdulazeem-code]

Kindly resolve conflicts