RBAC with hierarchy, cached permissions, and audit trail

[Jayrodri088]

Summary

• Introduce a shared RBAC module in contracts/traits/src/access_control.rs with:
  • role hierarchy and inheritance (SuperAdmin, Admin, domain-specific roles)
  • resource-level permission model (Resource + Action + Permission)
  • permission caching with epoch-based invalidation for gas-aware checks
  • audit logging for role/permission updates (PermissionAuditEntry)
• Export RBAC primitives through contracts/traits/src/lib.rs for reuse across contracts.
• Integrate the new RBAC system into key contracts:
  • contracts/oracle/src/lib.rs: replace admin guard logic with RBAC checks and bootstrap roles/permissions at initialization.
  • contracts/lib/src/lib.rs (PropertyRegistry): migrate high-impact admin-only operations to RBAC-backed checks and add role management/query messages (grant_role, revoke_role, has_role, get_permission_audit_entry).

Why

Access control logic was fragmented across contracts (owner-only checks, ad hoc admin checks, and contract-specific patterns), which increases security risk and maintenance cost. This change introduces a centralized, extensible RBAC baseline with stronger consistency and observability.

Scope / Notes

• This PR establishes the shared RBAC foundation and applies it to core/high-impact flows.
• Some contracts still use legacy access patterns and should be migrated in follow-up PRs for full repo-wide uniformity.

Test Plan

• cargo check -p propchain-traits
• cargo check -p oracle
• cargo check -p propchain-contracts
• Manual validation:
  • verify unauthorized callers fail RBAC-protected methods
  • verify admin/role holders can execute protected actions
  • verify role grant/revoke updates has_role outcomes
  • verify permission/role mutations write audit entries retrievable via get_permission_audit_entry

Closes: #76

[drips-wave]

@Jayrodri088 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits