feat: implement solutions for CT-14 and CT-19

[Penielka]

Summary

Implements solutions for two issues assigned to Penielka:

CT-14 (#93): Add role-based authorization checks for admin-only functions

• Replaced placeholder tests in access_control_role_tests.rs with comprehensive real tests covering:
  • Admin can perform all admin-only operations (set_role, blacklist, pause, update_config, remove_role)
  • Non-admin users cannot perform admin operations
  • Clear, specific error messages on permission failures (AdminRequired, InsufficientRole, Unauthorized, ContractPaused, NotInitialized)
  • Role escalation prevention (members cannot self-promote to admin)
  • Permission inheritance hierarchy (Admin > Member > Guest)
  • Comprehensive enforcement across all admin functions

CT-19 (#98): Add support for ownership transfer between administrators

• Added ProposalAction::TransferAdmin(new_admin) handling in execute_proposal
  • Multisig mode: Removes proposer from multisig admins list, adds new_admin, updates roles
  • Single-admin mode: Updates DataKey::Admin and swaps roles
  • Validates no duplicate admin in multisig list and validates config after update
• Added 3 new tests:
  • test_multisig_admin_transfer_via_proposal: Full flow success (verifies roles, multisig config, old admin loses privileges)
  • test_multisig_transfer_admin_to_self_fails: Self-transfer blocked with DuplicateAdmin
  • test_multisig_prevents_direct_admin_transfer: Direct transfer blocked in multisig mode

Additional Fixes

• Fixed duplicate enum variants in manage_hub/src/errors.rs (extra variants after closing brace)
• Added SubscriptionInvalid = 57 error variant (referenced by subscription.rs but was missing from enum)

closes #91
closes #92
closes #98
closes #93

[drips-wave]

@Penielka Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Qoder-Voidd]

LGTM