Admin role delegation: allow an admin to promote another address to admin

[leocagli]

Context

Currently admin operations require the original deployer key. This is a single point of failure — if that key is lost, no admin actions can be taken. Admin delegation allows a safe key rotation and multi-admin setups.

What to implement

Route: POST /api/admin/delegate

Body: { targetAddress: string }

• Validates targetAddress as a valid Stellar public key
• Adds targetAddress to the admin list
• Emits an admin.delegated audit log entry with actor + target + timestamp
• Requires current admin auth (existing middleware)

Route: DELETE /api/admin/delegate/:address

Revokes admin rights from the given address.

• Cannot revoke the last admin (returns 409 with error: 'cannot_remove_last_admin')

Route: GET /api/admin/list

Returns all current admin addresses:

{ "admins": ["GABC...", "GXYZ..."], "count": 2 }

Acceptance criteria

• POST /api/admin/delegate adds address and emits audit event
• Invalid Stellar address returns 400
• Delegating an already-admin address returns 409
• DELETE removes admin; trying to remove last admin returns 409
• GET /api/admin/list returns all current admins
• Unit tests: delegate, revoke, last-admin guard, list

🎁 Evidencia visual = reward extra

• Si tu PR incluye video demo o capturas de pantalla mostrando la funcionalidad pedida funcionando end-to-end, va a ser considerado para rewards de GrantFox en esta issue. No es obligatorio, pero suma mucho para la evaluación.