Harden time math, permit signature verification, and overflow safety

[khalyaro]

Summary

Closes #993, closes #994, closes #995, closes #996.

#993 — Bridge block-time overflow (contracts/bridge/src/lib.rs)

• Multisig request expiry, emergency request expiry, and the batch-verification rate window now use saturating_add instead of +, so u64::MAX timeouts can no longer wrap to an already-expired value.
• Tests: multisig timeout at u64::MAX still signs/executes normally; emergency request saturates at expires_at == u64::MAX; a u64::MAX duration rate window keeps both executed transactions inside one window.

#994 — Crowdfunding arithmetic overflow (contracts/crowdfunding/src/lib.rs)

• New CrowdfundingError::ArithmeticOverflow variant; invest() and buy_shares() compute all new totals (raised amount, share ledger) with checked_add before any storage write, so a single overflowing contribution is rejected atomically with no partial state.
• Milestone counter switched to saturating_add(1).
• Tests: u128::MAX contribution rejected leaving campaign untouched (a normal contribution afterwards still works); share-ledger saturation at u64::MAX shares rejects the next purchase without mutating balances.

#995 — EIP-712 permit signature verification (contracts/traits/src/eip712_permit.rs, contracts/property-management/src/permit.rs)

• verify_permit previously returned success on chain-id + nonce checks alone. It now recovers the ECDSA public key from the 65-byte signature over a domain-separated payload hash (PropChain:Eip712Permit:v1 binding chain_id, nonce, owner, spender, value, deadline) and requires it to equal the owner's registered public key.
• The orphaned property-management permit module was reconciled to the corrected API and wired into the crate: nonce replay guard, deadline guard, and signature recovery are all enforced by PermitRequest::validate_permit.
• Tests (secp256k1 dev-dependency, host-only): valid permit accepted including exactly-at-deadline boundary; wrong-signer forgery rejected; tampered payload rejected; wrong chain id / replayed nonce / expired deadline each rejected; message hash binds every field.

#996 — Compliance registry coverage (contracts/compliance_registry/lib.rs)

• Tax module lifecycle: only the owner can register tax modules; unauthorized updates fail with NotAuthorized; outstanding tax blocks require_compliance, cleared status reopens the gate, clearance expiry re-closes it, and clearance_expiry == 0 acts as permanent clearance.
• Verification revocation: revoked users flip to Rejected and lose compliance; revoking an unknown user fails with NotVerified.

All 132 tests across the five touched crates pass locally (cargo test -p propchain-traits -p propchain-bridge -p compliance_registry -p propchain-crowdfunding -p property-management).

[drips-wave]

@khalyaro Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits