Add admin recovery for Active matches stalled after oracle failure

[elvissamuel834-dotcom]

Summary

Fixes a critical security bug where an Active match (both players deposited) becomes permanently unrecoverable if the oracle fails to submit a result and the 24-hour player-initiated rollback window (dispute_and_rollback_match) expires.

Changes

Core Implementation

• admin_resolve_stalled_match(match_id, caller, resolution) — admin-gated recovery function usable only after 7 days since last_heartbeat with no result submitted
• ADMIN_STALL_WINDOW_SECONDS — 7-day threshold constant, long enough not to compete with player rollback (24h) but bounded so funds are never permanently locked
• Resolution supports: Winner::Player1, Winner::Player2, or Winner::Draw (refunds)
• Emits auditable ("match", "adm_stall") event distinct from oracle settlement

Tests (15 total)

• ✅ Stall window enforcement (rejection before 7 days)
• ✅ All resolution paths (Player1, Player2, Draw)
• ✅ Authorization (admin-only), state validation (Active-only), deposit checks
• ✅ Active match index cleanup
• ✅ Heartbeat preventing premature resolution
• ✅ Adversarial test: proves existing functions (cancel_match, expire_match, dispute_and_rollback_match) all fail to recover a stalled Active match, confirming the bug

Documentation

• Updated docs/architecture.md state transition table and valid transitions count
• Expanded docs/faq.md FAQ ## Fix: MatchCount can overflow u64 with no guard #9 with comprehensive oracle offline recovery guidance (Pending vs Active scenarios, timelines, CLI commands)
• Added CHANGELOG.md entry (Added + Fixed subsections)

Testing

Local verification:

cargo test -p escrow --lib admin_stall_resolution  # 15/15 passed
cargo test                                          # All 585 tests passed
cargo fmt --all --check                             # Formatted
cargo clippy --all-targets --all-features -- -D warnings  # No warnings

All CI checks expected to pass:

• ✅ Test suite
• ✅ Formatting
• ✅ Clippy
• ✅ Build

Context

Per docs/architecture.md's state machine, Active can only transition via oracle-authorized submit_result or player-initiated dispute_and_rollback_match. The latter enforces a 24-hour window from last_heartbeat — outside that window, the rollback is rejected with Error::VotingPeriodElapsed. With no admin function to move a match out of Active after that window closes, any match whose result submission is missed (down oracle, lost key, platform API outage >24h) has its stake permanently locked.

This PR closes that gap by adding an admin escape hatch after a 7-day stall threshold, ensuring funds are always recoverable while still giving the oracle ample recovery time for transient outages.

Closes #1274