feat: harden batch-sender (pause, admin, typed errors, multisig)

[Eltimios]

Overview

This PR completes the production-hardening pass for stealth-batch-sender. It adds a one-time init(admin, announcer, asset_policy) flow, admin-guarded pause/unpause controls, a typed BatchSenderError surface replacing all raw panic! branches, and a 7-day timelocked signer-rotation flow that mirrors stealth-sender. batch_send remains withdrawal-free and is now guarded by require_not_paused(). The PR also lands the ABI snapshot, regenerated TypeScript bindings, size budget tracking, and production tests for the new lifecycle and error paths.

Related Issue

Closes the batch-sender production-hardening bounty issue.

Changes

🛡️ Production-Hardening Core

• [ADD] stellar/stealth-batch-sender/src/lib.rs
  • Idempotent init(admin, announcer, asset_policy) with AlreadyInitialized typed error.
  • Paused storage plus admin-guarded pause, unpause, and is_paused, mirroring the stealth-sender pattern.
  • Replaces every raw panic! with a BatchSenderError enum: EmptyBatch, BatchTooLarge, NonPositiveAmount, EmptyEphemeralKey, Paused, NotInitialized, AssetNotAllowed.
  • Guards batch_send with require_not_paused(); no withdrawal path is added.

🔐 Signer-Set Multisig Rotation

• [ADD] stellar/stealth-batch-sender/src/multisig.rs
  • Reuses the stealth-sender/src/multisig.rs shape for signer-set storage and validation.
  • Adds propose_rotate_signers, approve_rotate_signers, and execute_rotate_signers with a 7-day timelock.
  • Includes adversarial guards for non-signer proposals, duplicate approvals, early execution, and invalid signer sets.

🧪 Production Test Suite

• [ADD] stellar/stealth-batch-sender/tests/production.rs
  • Covers init idempotency + AlreadyInitialized, pause/unpause, paused-call rejection, the full typed-error surface, and signer-rotation happy + adversarial paths.
  • Ensures batch_send rejects paused and uninitialized states with typed errors.

📦 ABI, Bindings, and Size Tracking

• [ADD] stellar/abi/stealth_batch_sender.json
  • Committed ABI snapshot for the hardened contract.
• [ADD] stellar/bindings/typescript/stealth-batch-sender/src/index.ts
  • Regenerated TypeScript bindings exposing init, pause, unpause, is_paused, propose_rotate_signers, approve_rotate_signers, execute_rotate_signers, and typed error unions.
• [MODIFY] stellar/SIZE.md
  • Records the optimized wasm size and confirms the 110 KB budget is still met.
• [MODIFY] stellar/PAUSE.md and stellar/MULTISIG.md
  • Batch-sender added to the pause and multisig support matrices.

Verification Results

cargo test -p stealth-batch-sender
✅ All tests passed

Hardening acceptance check:
✅ init idempotent + AlreadyInitialized
✅ pause / unpause + paused-call rejection
✅ typed BatchSenderError surface for every former panic! branch
✅ 7-day multisig rotation happy + adversarial paths
✅ optimized wasm under 110 KB budget
✅ ABI snapshot + TypeScript bindings regenerated

Acceptance Criteria	Status
cargo test -p stealth-batch-sender covers init, pause / unpause, paused-call rejection, typed-error surface, and signer-rotation happy + adversarial paths	✅ Covered in tests/production.rs
Optimized wasm still under the 110 KB budget recorded in stellar/SIZE.md	✅ Verified and recorded in stellar/SIZE.md
stellar/abi/stealth_batch_sender.json snapshot lands committed and the ABI CI gate is green	✅ Snapshot committed; ABI CI gate green
stellar/PAUSE.md and stellar/MULTISIG.md updated to include batch-sender in the matrix	✅ Docs updated
TypeScript bindings regenerated under stellar/bindings/typescript/stealth-batch-sender/	✅ Bindings regenerated

Closes #155