feat: Add admin action audit events for upgrade

[Gentleslyl2006]

Summary

• Emit an audit event containing the requested WASM hash when an admin triggers upgrade(); add unit tests and include the event schema for operators.

Motivation

• upgrade() is a privileged admin operation. Emitting a pre-upgrade audit event improves observability and allows operators/monitors to detect and validate proactive upgrade intentions before WASM is swapped.

Changes

• admin.rs: Added upgrade(e: Env, new_wasm_hash: BytesN<32>) which:
  • requires current admin authorization,
  • publishes an upgrade event with the requested WASM hash prior to performing the upgrade,
  • calls the deployer API to apply the WASM update.
• lib.rs: Exposed upgrade() on the public contract interface.
• test.rs: Added tests:
  • test_upgrade_emits_event — verifies the upgrade event is emitted and contains the requested hash.
  • test_upgrade_requires_admin_auth — verifies admin authorization is required.
  • test_upgrade_before_init_fails — verifies upgrade before initialization fails.

Event schema (for operators)

• Event name (topic 0): Symbol upgrade
• Topics: ( upgrade )
• Data payload: BytesN<32> — the requested WASM hash (sha256 of uploaded WASM blob)
• Emission timing: published immediately before the contract calls the deployer to update WASM.

Example event shape (semantic):

• Topics: [upgrade]
• Data: <wasm_hash: BytesN<32>>

Operators can watch for upgrade events and validate that:

• the listed WASM hash matches an uploaded blob they expect,
• the caller is the recorded admin address (via usual monitoring of transaction authorization).

Testing

• Run the contract unit tests:

cargo test --lib

• Or run only the new tests:

cargo test --lib test_upgrade_emits_event test_upgrade_requires_admin_auth test_upgrade_before_init_fails

Notes & Compatibility

• The event is emitted before invoking the deployer to update the contract WASM so off-chain observers can react before the code swap occurs.
• This change is backwards-compatible for callers (adds a new public method upgrade exposed from the contract).
• I included the event schema here to ensure operators can be updated immediately; if you prefer, I can add a short section to the repo docs describing the schema and monitoring recommendations.

Checklist

• Emit event containing requested WASM hash before upgrade
• Add tests for event emission and admin authorization
• Add repository documentation page describing the upgrade event schema (optional — I can add this in a follow-up commit)

Suggested commit message
feat(security): emit audit event for admin upgrade and add tests

Closes #270

[drips-wave]

@Gentleslyl2006 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits