all issue fixed

[Dev-Ben-Theo]

closes #257
closes #258
closes #259

SUMMARY:
257:
summary of what was done:

lib.rs

Added DataKey::PendingAdmin(u64) to store the nominated address between steps.
propose_admin(circle_id, new_admin) — requires current admin auth, writes new_admin to the pending slot, emits a prop_adm event. Rejects cancelled circles.
accept_admin(circle_id) — requires the nominated new_admin's auth, swaps Circle.admin, removes the pending slot, emits an acc_adm event. Rejects cancelled circles.
test.rs
— 6 new tests:

admin_transfer_full_flow — propose + accept + new admin cancels successfully
old_admin_cannot_cancel_after_transfer — confirms Circle.admin changed
new_admin_can_cancel_after_transfer — acceptance criterion check
propose_admin_on_cancelled_circle_reverts — Error::CircleCancelled
accept_admin_on_cancelled_circle_reverts — cancel between propose/accept
propose_admin_requires_current_admin_auth — auth chain check
README.md
— added both entrypoints to the method table and a new §Admin rotation section explaining the two-step rationale.

001-upgradeability.md
— updated decision 2 from "do not add rotation" to the adopted design, and updated the consequences to reflect that Circle.admin is now a live access-control root.

258:
summary of what was done:

lib.rs

Added round_deadline_ledgers: u32 and round_started_ledger: u32 to Circle. The started ledger is captured at create_circle and reset after claim and expire_round.
create_circle gains the round_deadline_ledgers parameter (inserted before vk).
New Error::RoundNotExpired = 9.
fund rejects deposits into an expired round (is_round_expired check before token transfer).
New expire_round(circle_id) — permissionless, resets the round (not cancel), refunds contributors, emits rnd_exp event.
New is_round_expired free function: current_sequence > started + deadline_ledgers.
test.rs

All 5 existing create_circle calls updated with &100_000u32 deadline (effectively infinite for existing tests).
New setup_expired helper creates circles with a short deadline for expiry tests.
6 new tests covering: happy-path expiry, before-deadline revert, empty-round expiry, full-pot revert, cancelled-circle revert, fund-into-expired revert, and fund-after-expiry works on the fresh round.
threat-model.md
— new file covering R1–R7 with cross-references to the relevant issues and mitigations.

README.md
— new expire_round row in the method table and a full §Round deadline and permissionless expiry section.

259:
All clean. Quick summary of every change:

lib.rs

Error::InvalidRecipient = 10 added with a clear doc comment.
claim: guard added as check 5 (after proof verification, before any state writes) — the nullifier is not consumed and the pot is not zeroed on a bad recipient.
cancel_circle and expire_round refund loops: identical guard inside the iterator. Defence in depth — the only route to a contract-address contributor today is a future bug in fund, so the check is cheap insurance.
test.rs

claim_to_contract_address_reverts: straightforward should_panic on #10.
claim_to_contract_address_does_not_consume_nullifier: confirms the failed claim leaves the nullifier unspent and the pot intact, then proves a legitimate claim still works — verifying no state was partially committed.
contract.ts

Pre-flight check in claim() comparing args.recipient to client.options.contractId. Throws a descriptive Error before paying any gas, with the on-chain error code in the message for debuggability.