feat: benchmark CI, OWASP scanning, contract auth audit & multi-sig admin ops

[quartune]

Summary

Closes Haroldwonder#935, Haroldwonder#936, Haroldwonder#937, Haroldwonder#253

Haroldwonder#935 — Performance regression benchmarks in CI

• New workflow .github/workflows/benchmark-ci.yml runs cargo bench --features benchmarks on every push/PR touching src/ or benches/
• Criterion JSON results saved as per-SHA artifacts (30-day retention)
• On PRs the workflow downloads the base-branch baseline and runs an inline Python script that compares mean timings; fails the build if any benchmark regresses > 20%
• Posts a markdown summary (regressions, improvements, new benchmarks) to the GitHub step summary

Haroldwonder#936 — OWASP dependency vulnerability scanning

• New workflow .github/workflows/security-audit.yml runs npm audit --audit-level=high for backend, frontend, api, examples; plus cargo audit for Rust deps
• Triggers on push/PR (lock-file changes) and weekly on Monday 06:00 UTC
• New .github/dependabot.yml configures weekly Dependabot PRs for all npm directories, the Cargo workspace, and GitHub Actions; minor/patch updates are grouped to reduce noise

Haroldwonder#937 — Smart contract authorization audit

• Enumerated all #[contractimpl] functions and verified each state-mutating function has an explicit auth check (require_admin, require_auth, or agent registration check)
• Added SECURITY.md with the full authorization model: role table, per-function auth table, multi-sig flow description, and defence-in-depth summary
• No missing authorization checks found; all functions verified ✅

Haroldwonder#253 — Multi-signature admin operations

• src/types.rs: new AdminOperationType enum (UpdateFee, WithdrawFees, Pause, Unpause) and PendingOperation struct (id, operation_type, proposer, approvers, threshold, proposed_at, ttl_seconds, fee_bps, withdraw_to)
• src/errors.rs: four new error variants — OperationNotFound(56), AlreadyApproved(57), OperationExpired(58), InvalidMultiSigThreshold(59)
• src/storage.rs: new keys MultiSigThreshold, MultiSigTtlSeconds, OperationCounter, PendingOp(u64) and CRUD helpers
• src/multisig.rs: new module with set_multisig_config, propose_operation, approve_operation, expire_operation, get_operation, and internal execute_operation dispatch
• src/events.rs: four new events — msig/proposed, msig/approved, msig/executed, msig/expired (all include SCHEMA_VERSION + ledger sequence/timestamp)
• src/lib.rs: five new public contract entry points exposing the multi-sig API
• Defaults: threshold=1 (single-admin, backwards-compatible), TTL=86 400 s; configure with set_multisig_config

Security analysis (Haroldwonder#253)

• Proposer and approvers must each pass require_admin (which calls require_auth on-chain), preventing impersonation
• Duplicate-approval protection: AlreadyApproved is returned if the same admin tries to approve twice
• TTL expiry: operations that exceed ttl_seconds are swept out of storage on the next approve_operation or explicit expire_operation call — no dangling state accumulates
• Threshold=1 default means the contract behaves identically to before until set_multisig_config is called

Test plan

• Deploy a local Soroban testnet environment and call initialize then set_multisig_config(2, 3600)
• Call propose_operation(UpdateFee, 300, None) as admin-1; verify msig/proposed + msig/approved events, pending op stored
• Call approve_operation(op_id) as admin-2; verify msig/approved + msig/executed, fee updated, pending op removed
• Call propose_operation and wait for TTL; call expire_operation; verify msig/expired event
• Verify non-admin cannot call propose_operation or approve_operation (returns Unauthorized)
• Push a PR that intentionally slows a benchmark by 30%; verify benchmark CI fails
• Run npm audit --audit-level=high locally in each service directory; verify CI step matches