Feature/914 915 916 917 escrow release controls

[OZILSOLAR]

Title:
feat(invoice-escrow): co-signer approvals, oracle guards, scheduled release & refund grace period

Description:

Summary

Adds four release/refund controls to the invoice-escrow contract. All of them are opt-in per invoice. They plug into one shared release check,
check_release_gates, which both release and the auto-release in deposit use. If a configured check isn't satisfied, a fully funded invoice stays
Active until release is called after it clears. Invoices that don't configure any of these behave exactly as before.

#914: Co-signer approval system

• CosignerApproval record (signers, threshold, approvals, rejections, status Pending/Approved/Rejected)
• set_cosigners (creator only; locked once voting starts), approve_release, reject_release, revoke_vote
• Signers are checked with require_auth plus a membership check; duplicate votes are rejected, so concurrent or replayed votes can't inflate the count
• UI views: get_approval, get_approval_status, has_approved, approvals_remaining
• Events for configuration, each vote and status changes

#915: Oracle condition guards

• New oracle.rs: PriceOracle interface (SEP-40-style lastprice)
• OracleCondition: comparator (GreaterOrEqual/LessOrEqual), threshold, staleness window, optional fallback oracle; set by the creator while the
  invoice is Pending
• Oracles are called with try_lastprice, so a failing oracle reports OracleUnavailable instead of aborting; stale, non-positive and future-dated
  prices are rejected
• Falls back to the secondary oracle when the primary fails and emits an orc_fback event
• Admin override clear_oracle_condition for oracles that are permanently down
• Views: check_oracle_condition, get_oracle_condition, get_last_oracle_reading

#916: Scheduled release

• ReleaseSchedule: release_at timestamp plus unlock_ledger (minimum ledger count), status Scheduled/Executed/Cancelled
• schedule_release / cancel_release_schedule (creator only); release needs both the time and the ledger bound to have passed
• Extends the schedule's and invoice's storage TTL past the unlock ledger so both are still stored when the release comes due
• Views: get_release_schedule, is_release_due, seconds_until_release, ledgers_until_release

#917: Refund grace period

• Admin default set_default_refund_grace, copied onto each new invoice (later changes never affect existing invoices)
• Creator per-invoice override set_refund_grace (before any deposits)
• Admin overrides: extend_refund_grace (max 30 days total) and waive_refund_grace
• refund now returns RefundGraceActive while the grace timer is running
• Status NoGrace/NotStarted/Active/Elapsed/Waived through get_refund_grace_status; countdown views refund_grace_remaining and
  refund_available_after

Other

• New error variants 20–40, added after the existing ones (existing codes unchanged)
• Test modules for each feature in src/test.rs, including mock oracle contracts (configurable and always-failing)

Not yet built or run locally. Please run cargo test -p invoice-escrow; CI checks need to pass before review.

Closes #914
Closes #915
Closes #916
Closes #917

[drips-wave]

@OZILSOLAR Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits