feat: reputation score query, multi-sig proposal expiry, and appeal/evidence deadlines

[memplethee-lab]

Summary

Implements four contract-side gaps — a portable reputation score, explicit multi-sig proposal expiry, a bounded appeal window, and a single dispute evidence deadline shared with escrow.

Closes #974
Closes #975
Closes #976
Closes #977

Changes

#974 — Reputation score query

• New reputation::get_score(subject) -> ReputationScore and get_aggregate(subject) -> ReviewAggregate.
• The aggregate is maintained on write by submit_review, moderate_review, file_appeal, and resolve_appeal, so a read is O(1) and never rescans the review set. Stored at DataKey::Aggregate(Address).
• Pure projection lives in reputation/src/score.rs (host-free, unit-tested): average_rating_x10 and weighted_score_x10 (neutral-prior blend so one review does not read as perfect). All components are exposed for audit.
• Authority: search::set_rating is documented as a private ranking hint; reputation is the authoritative source. Unifying them would mean search reading this contract — raised here as a maintainer decision rather than guessed at.
• Trade-off: a subject's reviews are summarised by a maintained aggregate rather than an id index; per-review enumeration is intentionally not offered, because review_id is caller-chosen and an index adds a second O(n) write path.

#976 — Appeal window + moderation-queue bound

• set_appeal_window / get_appeal_window (admin), get_appeal_deadline, ledgers_to_appeal. file_appeal rejects with AppealWindowClosed once the chain passes the deadline (the deadline ledger itself is still inside the window); AppealRecord records window_deadline_ledger.
• report_review now rejects with QueueFull at MAX_QUEUE_SIZE (256) and ReportLimitReached at MAX_REPORTS_PER_REVIEW (16) before writing.
• Tests cover inside the window, exactly at the boundary, outside it, and both caps.

#975 — Multi-sig proposal expiry

• expire_proposal(proposal_id, executor) closes an elapsed Pending proposal as Expired: NotExpired before the deadline, ProposalClosed once closed. Approvals are retained for audit but can no longer finalise.
• is_expired and ledgers_until_expiry surface the expired state without waiting for a finalize failure.

#977 — Dispute evidence deadline

• dispute_arbiter gains submit_evidence / get_evidence / get_evidence_count, get_dispute_deadline, ledgers_until_deadline, and set_dispute_ttl_ledgers / get_dispute_ttl_ledgers.
• DisputeRecord.auto_resolve_ledger is renamed deadline_ledger and is now the single timer: evidence is refused after it and auto_resolve becomes callable at it.
• Both escrow and dispute_arbiter source their default and ceiling from the new shared::dispute constants, so the two contracts cannot disagree about a dispute's time bound. Tests in each crate assert they read the same shared source.

Storage / compatibility

• storage-schema bumped 1 -> 2 for reputation, multi_sig, and dispute_arbiter (new keys and a renamed field).
• New error codes appended, never renumbered: reputation 13-16, multi_sig 15, dispute_arbiter 11-13. Each is pinned by a test.
• docs/STORAGE.md updated for all three crates; CHANGELOG.md updated.

Testing

Unit tests added for every behaviour above. Not executed here (per instructions); the maintainer runs cargo test.

[drips-wave]

@memplethee-lab Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[DevMuhdishaq]

Merged after resolving one merge conflict against main.

Conflict resolution (merge commit 49555d3):

• contracts/shared/src/lib.rs: both main (refactor(shared): extract require_initialized pattern into shared::initialization #1041) and this branch added a pub mod line in the same spot. Kept both: pub mod dispute; (this branch) and pub mod initialization; (refactor(shared): extract require_initialized pattern into shared::initialization #1041). No other changes were affected.

Everything else in this PR (storage/dispute/reputation/multi-sig updates) applied cleanly. Thanks!