[NF-07] [CONTRACT] Emergency Pause / Circuit Breaker #82

Overview

There is no way to halt user-facing operations during an active incident (e.g. a discovered bug being actively exploited). This issue adds a Guardian-multisig-gated pause switch.

Problem

VaultRouter.deposit/withdraw/early_exit have no paused/unpaused check anywhere. If a critical bug were discovered in production, the only mitigation available today is the 72-hour Governance timelock (too slow for an active exploit) — there is no fast-acting stop mechanism at all, for any role.

Proposed Solution

• Add DataKey::Paused (bool) to VaultRouter.
• Add pause() / unpause(), both requiring auth from the Guardian address (the same address registered in Governance, ideally the multisig from NF-06 so no single key can pause/unpause unilaterally).
• Add a require_not_paused() internal check called at the top of deposit, withdraw, and early_exit. Deliberately do not gate read-only functions like position() — users must still be able to see their funds while paused.
• Emit a contract event on pause/unpause transitions for off-chain monitoring/alerting.

Acceptance Criteria

• deposit/withdraw/early_exit all revert with a clear ProtocolPaused error while paused
• position() and other read-only calls continue to work while paused
• Only the Guardian address can call pause/unpause
• Pause/unpause emits an event
• Unit tests cover: deposit rejected while paused, deposit succeeds after unpause, pause call from non-Guardian address rejected