feat: add oracle admin rotation

[snkk2x-collab]

Summary

• add two-step oracle admin rotation to score-registry with propose_admin, accept_admin, and pending_admin
• require the registry to be paused before a new admin can be proposed, so score writes cannot continue during rotation
• emit Soroban events for score updates and admin rotation using the SDK-supported env.events().publish API
• add a dry-run-first Server/scripts/rotate-oracle-admin.ts helper and document the Vercel rotation runbook

Notes

While adding the rotation tests, cargo test exposed two existing SDK-compatibility issues in the contract test path: contractevent is not available in the resolved Soroban SDK version, and set_scores_batch re-entered admin auth for every row. This PR switches events to the supported manual event API and shares the score-write helper so batch auth is performed once.

Validation

• PATH="$HOME/.cargo/bin:$PATH" cargo test
• ts-node scripts/rotate-oracle-admin.ts exits with the expected usage message and no TypeScript/import errors