feat(contracts): add timelock controller, NFT certificate validation,…

[teefeh-07]

Summary
This PR resolves three contract-side issues:

Closes #657 — Add a timelock controller to platform-governance
Closes #654 — On-chain validation of certificate metadata in nft-certificate
Closes #656 — Optimize balance/storage keys in tree-token
#657 — platform-governance timelock controller
Tasks & fixes:

Added Queued and Canceled variants to ProposalStatus.
Added a QueuedProposal record (proposal id, queued_at, executable_at, canceled flag) and persistent storage key.
Added queue(proposal_id) to move a Passed proposal into the timelock queue; executable_at is computed as now + timelock_seconds.
Added cancel_queued_proposal(proposal_id) — admin-only emergency cancel.
Modified execute(proposal_id) to require Queued status and enforce the queued executable_at.
Enforced a 48-hour minimum timelock in update_timelock.
Added set_paused(paused) admin function and is_paused() getter (the pause flag was previously read but never set).
Added get_queued_proposal() getter.
Updated and expanded unit tests to cover queue → execute, early-execute rejection, admin cancel, and minimum-timelock enforcement.
#654 — nft-certificate metadata validation
Tasks & fixes:

Created new workspace member contracts/nft-certificate with a SEP-41 style NFT contract.
Implemented initialize, mint, owner_of, token_uri, approve, get_approved, transfer, transfer_from, name, and symbol.
mint performs on-chain validation of certificate metadata:
tree_count > 0 → HarvestaError::TreeCountMustBePositive
co2_offset_kg > 0 → HarvestaError::Co2MustBePositive
planting_date <= env.ledger().timestamp() → HarvestaError::InvalidPlantingDate
Enforces unique token_id; duplicates panic with HarvestaError::TokenAlreadyMinted.
Added NFT-specific error codes to harvesta-errors.
Added unit tests for valid mint, duplicate-token rejection, zero tree count, zero CO₂ offset, and future planting date.
Note: because on-chain JSON parsing of a metadata URI is impractical on Soroban, the contract accepts the structured metadata fields directly as arguments alongside metadata_uri. This keeps validation enforceable on-chain.

#656 — tree-token storage optimization
Tasks & fixes:

Collapsed four instance-storage entries (ADMIN, TOKEN, PAUSED, BURNCOUNT) into a single Config struct keyed by DataKey::Config.
Replaced persistent keys (Symbol("BURN"), u64) with typed DataKey::BurnRecord(u32).
Downsized burn index / count from u64 to u32.
Profiling / footprint comparison:
Instance ledger entries: 4 → 1 (-75%)
Persistent key encoding: Symbol + u64 → enum discriminant + u32
Burn index size: 8 bytes → 4 bytes
WASM build remains healthy (~30 KB)
Note: tree-token does not hold token balances itself (balances live in the Stellar Asset Contract). The optimization therefore targets the wrapper state and the ESG audit-log keys that the issue maps to as on-chain storage.

Workspace changes
contracts/Cargo.toml: added nft-certificate as a workspace member.
contracts/Cargo.lock: regenerated to include the new member.
Verification
✅ cargo check -p platform-governance -p nft-certificate -p tree-token
✅ cargo build --release --target wasm32-unknown-unknown -p platform-governance -p nft-certificate -p tree-token

Closes #657
Closes #654
Closes #656

[drips-wave]

@teefeh-07 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Idrhas]

Fix merge conflict and dont forget to Offramp your USDC on https://fundable.finance when you receive your rewards