feat(governance): emit events for signer and admin changes

[shaaibu7]

Closes #637

Summary

fluxora_governance emitted events for the proposal lifecycle but mutated critical membership/admin state silently. add_signer, remove_signer, and set_admin now emit structured events so indexers can reconstruct the signer set and admin history from chain events alone.

Changes

Contract (contracts/governance/src/lib.rs)

• Added three #[contracttype] event structs (with /// docs):
  • SignerAdded { signer }
  • SignerRemoved { signer }
  • AdminChanged { old, new }
• Published them with distinct, non-colliding symbol_short! topics:
  • add_signer → ("sgnr_add",)
  • remove_signer → ("sgnr_rm",)
  • set_admin → ("adm_chg",)
• All events emitted after the state mutation is persisted (CEI). set_admin captures the old admin before overwriting so the event carries both old and new. remove_signer publishes only inside the matched-index branch, so removing an unregistered address stays a silent no-op.

Tests (contracts/stream/tests/governance_integration.rs)

• Snapshot/assertion tests verifying topics and payloads for all three events.
• Admin rotation chain test confirming old/new are correct across consecutive rotations.
• Negative no-event coverage: removing a non-existent signer, a QuorumWouldBreak-rejected removal, and a DuplicateSigner-rejected add all emit no event.

Docs (docs/governance.md)

• New "Membership and admin events" table (topics, payloads, emission rules).
• Per-entrypoint event notes, a new security consideration (Add custom error enum and Result returns to public functions #15), and updated test coverage list.

Incidental fixes

The governance_integration.rs test target did not compile on main, so its tests had never run. Two pre-existing issues were fixed to enable the suite:

1. test_init_duplicate_signers_errors called try_init with 2 args (missing threshold).
2. test_execute_at_expiry_boundary_succeeds asserted TimelockNotElapsed despite its name — at created_at + MAX_AGE the 48h timelock has long elapsed, so it succeeds. Aligned with its lib.rs twin.

Acceptance criteria

• Each membership/admin mutation emits a structured event
• Topics are unique and documented
• remove_signer of a missing address emits no spurious event
• Snapshot/assertion tests cover topics and payloads

Test output

• cargo test -p fluxora_governance --lib → 50 passed
• cargo test -p fluxora_stream --test governance_integration → 49 passed

Security notes

• Events follow CEI: state is persisted before emission.
• An emitted event faithfully implies a real state change — no-op and rejected mutations emit nothing.
• AdminChanged carries both old and new, making the full admin rotation chain reconstructable from events without reading historical state.

[drips-wave]

@shaaibu7 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Jagadeeshftw]

emitting sgnr_add, sgnr_rm and adm_chg events gives indexers a clean audit trail for membership and admin changes, and i like that the publishes stay CEI-after-persist. this collided with the new map-backed membership index on main, so i rebased and combined the two: the add/remove paths keep the O(1) signer_index updates and also emit your events (the silent no-op on removing a non-member happens before any event, as intended). builds clean.