feat(zkgm): add per-denom pause gate across send/recv/ack/timeout

[aronpark1007]

Summary

Adds PausableDenom, an admin-gated per-denom pause switch alongside the existing global Pausable. It lets an incident response freeze a single asset's movement without halting the whole app.

Changes

• admin.gno: PausableDenom(cur, denom, p) entrypoint, admin-gated via access manager
• store.gno: Store.SetDenomPaused/GetDenomPaused (unpausing removes the entry instead of storing false)
• types.gno: IStore/IAppGetter extended with the new methods; getters.gno exposes GetDenomPaused
• v1/token_order.gno: pause guard enforced at every point a denom's balance actually moves
  • send: verifyTokenOrderV2 rejects before escrow (all order kinds, not just INITIALIZE/ESCROW)
  • recv: executeTokenOrderV2 aborts via execFatal panic, not a graceful failure ack
  • ack/timeout: acknowledgeTokenOrderV2/refundV2 reject before refund/release/burn settlement
• v1/forward.gno: doc comment only — records why the forwarded child's async ack-write is intentionally not pause-gated (no local asset moves there)

Test

• Unit tests for all four guarded paths (send/recv/ack/timeout) plus admin-gate and store-level tests
• 4 scenario filetests: pause_denom_authority_by_caller, pause_denom_reject_send, pause_denom_reject_ack, pause_denom_reject_timeout
• gno lint/gno test pass across ucs03_zkgm, ucs03_zkgm/v1, and scenario/union/pause