Feat/add bulk allow addresses entrypoint

[whisper011]

Summary
feat(compliance): Add bulk_allow_addresses entrypoint that atomically onboards a batch of addresses to the allowlist in a single transaction, reusing the per-address allow logic and emitting an address_allowed event for each entry.
feat(compliance): Add bulk_block_addresses entrypoint that blocks a batch of addresses in a single transaction, following the same emergency policy as block_address (permitted while paused) and emitting an address_blocked event for each entry.
test(compliance): Add regression test block_flag_overrides_allow_flag_in_is_allowed that explicitly documents and guards the invariant that a Blocked = true flag takes precedence over Allowed = true in is_allowed.
chore(treasury): Extract contracts/treasury/src/multisig.rs and settlement.rs into a new crates/multisig workspace crate (comebackhere-multisig). Treasury now depends on the crate and imports types/helpers directly from it. The workspace Cargo.toml is updated to include the new member.
Test plan
cargo test -p comebackhere-compliance — all existing compliance tests pass; new bulk entrypoints and block-overrides-allow test covered
cargo test -p comebackhere-treasury — treasury tests pass after multisig extraction; re-exported types remain accessible as treasury::{Settlement, TreasuryError, …}
cargo build -p comebackhere-multisig — new crate builds cleanly as a standalone workspace member
Closes #60
Closes #61
Closes #62
Closes #63

[drips-wave]

@whisper011 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits