feat(stellar/wraith-names): multi-sig social recovery (#20)

[Dennis-Ritchie1]

closes #20
Description:

Implements issue #20 — guardian-based social recovery for the wraith-names Soroban contract.

Changes

New types

• GuardianConfig { guardians: Vec<Address>, threshold: u32 } — stored per name under DataKey::Guardians
• RecoveryProposal { new_owner, new_meta_address, proposed_at, approvals } — stored per name under DataKey::Recovery
• DELAY_WINDOW = 100_000 ledgers between proposal and execution

New functions

• set_guardians(name, guardians, threshold) — owner-only; max 7 guardians, 1 ≤ threshold ≤ len; clears any pending proposal
• propose_recovery(proposer, name, new_owner, new_meta_address) — guardian-only; creates proposal with proposer auto-added to approvals
• approve_recovery(approver, name) — guardian-only; executes recovery when threshold met AND delay elapsed, then clears guardians and proposal
• cancel_recovery(name) — owner-only; cancels within the delay window

New error variants
NotOwner, NotGuardian, NoProposal, ProposalAlreadyExists, AlreadyApproved, DelayNotElapsed, ThresholdNotMet, TooManyGuardians,
InvalidThreshold

Tests

8 tests covering all specified scenarios: happy path, insufficient approvals, delay not elapsed, cancel by owner, non-guardian rejection, double
approval, post-recovery state cleared, and set_guardians clearing a pending proposal.

Notes

• No existing registration, update, release, or resolve logic was changed
• propose_recovery and approve_recovery take an explicit Address argument for the caller — required in Soroban since there is no implicit
  msg.sender

[drips-wave]

@Dennis-Ritchie1 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[truthixify]

Nice implementation — the four entrypoints (set_guardians, propose_recovery, approve_recovery, cancel_recovery) cleanly map to the design in the issue, and the adversarial coverage (insufficient threshold, delay-not-elapsed, post-cancel approval, double-approval, non-guardian rejection, proposal-cleared invariants) is thorough.

test_set_guardians_clears_proposal is the kind of subtle invariant test that catches real bugs — good catch.

Thanks @Dennis-Ritchie1.