Admin role transfer has no two-step confirmation

[boluwacodes]

Transferring the admin role to a new address happens in a single call with no acceptance step from the new address, so a typo'd address would permanently lock out admin control.

Proposal: Implement a two-step transfer (propose + accept) pattern for the admin role.