security: extend pause gate to all state-changing entrypoints

[Baskarayelu]

Summary

Previously only record_usage and settle respected the Paused
emergency-stop flag, while admin config and registry mutations still ran
while the contract was paused. This extends the pause gate consistently
to every state-changing config/registry entrypoint.

Closes #23

Changes

• Added a private helper ensure_not_paused(env) next to
  read_flag / write_flag that panics with ContractPaused (#4)
  when paused, centralising the check so new mutating entrypoints cannot
  forget it.
• Called ensure_not_paused(&env); right after the admin load +
  require_auth() in all 11 config-mutation entrypoints:
  set_service_price, register_service, unregister_service,
  set_service_disabled, set_service_metadata,
  clear_service_metadata, set_agent_allowed,
  set_allowlist_enabled, set_require_service_registration,
  set_min_requests_per_call, set_max_requests_per_call.
  (transfer_service_ownership already had its own pause check; left as-is.)
• Added docs/escrow/security.md documenting the full pause matrix.
• Added tests for representative gated entrypoints plus a check that
  unpause() and a read getter still work while paused.

Security notes

• Lifecycle controls intentionally bypass the gate so the operator
  retains control during an incident: pause, unpause,
  propose_admin_transfer, accept_admin_transfer,
  cancel_admin_transfer, migrate_v1_to_v2, and init.
• All read-only getters remain callable while paused.
• Reuses the existing EscrowError::ContractPaused = 4; the error enum
  is unchanged (still append-only, max code #14).
• The check runs after admin.require_auth(), so authorization
  semantics are unchanged; the pause gate is an additional barrier, not
  a replacement.

Test result

test result: ok. 56 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out

🤖 Generated with Claude Code