Add admin access control integration tests 558

[Stanley-Owoh]

Add integration tests for admin-only function unauthorized access

Summary

Added creator-keys/tests/admin_unauthorized.rs — an integration test file that verifies all admin-gated functions revert with ContractError::Unauthorized when called by a non-admin address, and that no contract state is mutated on failed calls.

Admin-gated functions covered

These are all functions that check admin identity via assert_is_admin() (lib.rs:871):

Function	Source location
pause	lib.rs:1885
unpause	lib.rs:1898
update_protocol_fee_recipient	lib.rs:2763
withdraw_treasury	lib.rs:2990

Tests added (8 total)

Test	What it verifies
test_pause_reverts_for_non_admin	pause returns Unauthorized for non-admin
test_pause_no_state_change_on_non_admin_call	get_is_paused() unchanged after rejected call
test_unpause_reverts_for_non_admin	unpause returns Unauthorized for non-admin
test_unpause_no_state_change_on_non_admin_call	get_is_paused() unchanged after rejected call
test_update_protocol_fee_recipient_reverts_for_non_admin	update_protocol_fee_recipient returns Unauthorized for non-admin
test_update_protocol_fee_recipient_no_state_change_on_non_admin_call	get_protocol_fee_recipient() unchanged after rejected call
test_withdraw_treasury_reverts_for_non_admin	withdraw_treasury returns Unauthorized for non-admin
test_withdraw_treasury_no_state_change_on_non_admin_call	get_treasury_balance() unchanged after rejected call

Scope note

Functions that only use require_auth() without assert_is_admin() (set_fee_config, set_key_price, set_curve_slope, set_treasury_address, set_protocol_admin, set_protocol_fee_recipient) are not admin-gated in the identity-check sense — any address that authorizes the call can invoke them. These are excluded from this test scope.

Acceptance criteria

• All admin-gated functions covered
• Each reverts with the Unauthorized error code (18) when called by non-admin
• No state mutation on failed admin calls
• Test keypair is explicitly not the contract admin (Address::generate)

Closes #558