feat: Add emergency pause with owner override and unpause timelock (#195)

[xion-19]

Summary

Implements emergency pause functionality that allows the contract owner to halt all purchases and transfers in case of vulnerability discovery, with a timelock for unpause.

Resolves #195

Changes

• emergency_pause() — Owner-only (#[only_owner]), instantly pauses the contract without requiring multisig approval. This enables fast response during vulnerability discovery.
• propose_unpause() — Owner-only, starts a 24-hour cooldown before unpause takes effect.
• confirm_unpause() — Owner-only, executes the unpapse after the cooldown has elapsed.
• cancel_unpause() — Owner-only, cancels a pending unpause proposal.
• get_pending_unpause() — Read-only, returns the pending unpapse timestamp (if any).

Design

Aspect	Decision
Timelock duration	24 hours (EMERGENCY_UNPAUSE_COOLDOWN_SECS = 86400)
Who can pause	Owner only (no multisig needed for fast emergency response)
Who can unpause	Owner only, but only after 24h cooldown
Multisig pause	Preserved — existing set_pause_status still works
Safety on re-pause	emergency_pause clears any pending unpause proposal

New Error Variants

• EmergencyAlreadyActive (55) — contract is already paused
• UnpauseNotProposed (56) — no pending unpause to confirm/cancel
• UnpauseCooldownNotElapsed (57) — 24h cooldown has not yet passed

New Events

• EmergencyPaused — emitted when owner triggers emergency pause
• UnpauseProposed — emitted when unpause is proposed with timestamp
• UnpauseConfirmed — emitted when unpapse is confirmed after cooldown
• UnpauseCancelled — emitted when a pending unpapse is cancelled

Tests (11 new tests)

• test_emergency_pause_owner_can_pause — owner can pause immediately
• test_emergency_pause_rejects_already_paused — rejects double-pause
• test_emergency_pause_blocks_operations — create_prompt blocked when paused
• test_emergency_pause_clears_pending_unpause — re-pause clears pending unpause
• test_propose_unpause_requires_paused_state — propose fails when not paused
• test_propose_and_confirm_unpause_with_cooldown — full propose/confirm flow with 24h check
• test_confirm_unpause_requires_proposal — confirm fails without proposal
• test_cancel_unpause — cancel removes proposal, contract stays paused
• test_cancel_unpause_requires_proposal — cancel fails without proposal
• test_emergency_pause_multisig_still_works — existing multisig pause/unpause preserved
• test_emergency_pause_get_pending_unpause_none_when_no_proposal — query returns None initially

Frontend Tests

Frontend tests (vitest) show 35 failures / 74 passed — same results before and after this change. All failures are pre-existing and unrelated to the smart contract changes.

Files Changed

• contracts/prompt-hash/src/contract.rs — 5 new methods + 1 constant (+52 lines)
• contracts/prompt-hash/src/types.rs — 3 Error variants, 1 DataKey, 5 trait declarations (+29 lines)
• contracts/prompt-hash/src/storage.rs — 3 storage methods for unpapse timelock (+22 lines)
• contracts/prompt-hash/src/events.rs — 4 new events and emitters (+36 lines)
• contracts/prompt-hash/src/test.rs — 11 new tests (+220 lines)

Total: +359 lines across 5 files

[drips-wave]

@xion-19 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits