feat(stellar): add on-chain multisig quorum rotation for signers

[EmperorNexus]

Overview

This PR adds an on-chain multi-sig quorum rotation flow to \stealth-sender\ and \wraith-names\ — the two Timelock + Multisig Upgradable contracts per GOVERNANCE.md. Instead of requiring a full contract redeploy to change signers or threshold, current governance signers can now propose, approve, and execute rotations behind a 7-day timelock.

Related Issue

Closes #104

Changes

Multisig Rotation Module

• [ADD] \stellar/stealth-sender/src/multisig.rs\ — on-chain quorum + timelock signer-rotation logic for \stealth-sender\
• [ADD] \stellar/wraith-names/src/multisig.rs\ — on-chain quorum + timelock signer-rotation logic for \wraith-names\
• [ADD] \init_multisig, \signers, \ hreshold, \pending_rotation\ — state query methods
• [ADD] \propose_rotate_signers\ — propose new signer set + threshold (auto-approves caller)
• [ADD] \�pprove_rotate_signers\ — current signers add approval until quorum met
• [ADD] \execute_rotate_signers\ — executes rotation once quorum + 7-day timelock elapse; emits \SignersRotated\ event
• [ADD] \cancel_rotate_signers\ — aborts pending rotation and clears proposal state

Validation & Safety

• [ADD] \InvalidThreshold\ error for zero or threshold > signer count — rejects quorums that could never be reached
• [ADD] \RotationAlreadyPending\ / \NoPendingRotation\ — prevents duplicate proposals and stale operations
• [ADD] \QuorumNotMet\ / \TimelockNotElapsed\ — guards against premature execution
• [ADD] Cancellation fully clears pending proposal state so a fresh rotation can start immediately

Documentation

• [ADD] \stellar/MULTISIG.md\ — rotation runbook with propose → approve → timelock → execute flow, CLI examples, and state inspection commands

Verification Results

\
cargo test -p stealth-sender
✅ 7/7 passed (5 new multisig tests + 2 existing)

cargo test -p wraith-names
✅ 5/5 passed (existing tests, no regressions)
\\

Acceptance Criteria

Criteria	Status
Rotation requires quorum + timelock	✅ \ est_rotate_signers_requires_quorum_and_timelock\ — approve 3-of-5, advance ledger by 7 days, execute
Invalid thresholds rejected with dedicated error	✅ \ est_init_multisig_rejects_invalid_threshold\ + \ est_propose_rotate_signers_rejects_invalid_threshold\
Test covers cancelled-mid-rotation state cleanup	✅ \ est_cancelled_rotation_clears_state\ — cancel clears proposal, original signers untouched, stale ops fail, fresh proposal allowed
MULTISIG.md runbook	✅ Documented with CLI commands for propose/approve/execute/cancel and state inspection (futurenet rehearsal noted as follow-up)