Security: Add rate limiting, audit events, and event indexing to contracts

[hardcordev]

Summary

Hardens the payment escrow and remittance hub contracts against
transaction spam on batch operations, closes gaps in the on-chain audit
trail for admin/compliance/recurring-escrow actions, normalizes
dispute/approval events onto the contract's indexable event schema, and
removes a redundant storage read from the escrow release/refund hot
paths.

Changes

• Rate limiting (contracts/src/rate_limit.rs, remittance_hub.rs):
  Added a FunctionType::Batch variant and wired enforce_rate_limit
  into batch_create_escrows, batch_deposit, and batch_release,
  which previously had no rate limiting despite every other
  state-changing operation in the hub being protected.
• Audit trail (contracts/src/payment_escrow.rs): Added structured
  events::emit calls (the contract's existing GpayEvent
  timestamp/actor/amount/status/data schema) to state-changing
  operations that previously left no record: add_supported_asset,
  register_compliance_rule, set_user_jurisdiction,
  admin_override_compliance (a compliance bypass), and
  create_recurring_escrow / cancel_recurring_escrow.
• Event indexing (contracts/src/payment_escrow.rs): The multi-party
  approval and dispute functions (add_approver, remove_approver,
  revoke_approval, raise_dispute, vote_on_dispute,
  resolve_dispute) were publishing events via raw
  env.events().publish(...) calls with topics/payloads outside the
  contract's standard (gpayremit, component, action, id) schema, so an
  indexer built around that schema would miss them entirely. Normalized
  all six to use the existing events::emit helper.
• Cost optimization (contracts/src/payment_escrow.rs):
  enforce_rate_limit now returns the admin address it already reads
  from storage, and the six release/refund entry points
  (release_escrow, release_asset, release_partial,
  refund_escrow, refund_asset, refund_partial) reuse that value
  for their authorization check instead of reading DataKey::Admin a
  second time, removing a redundant instance-storage read on every
  release/refund call.

Issues

Resolves #300
Resolves #299
Resolves #298
Resolves #297

Verification

• Manual code review of the full diff was performed; no automated
  review tool was used.
• cargo build was not run.
• cargo test was not run.
• No test snapshots or generated files were added or modified.

[drips-wave]

@hardcordev Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits