Implement payroll proof expiry enforcement

[edehvictor]

Summary

Add contract checks that reject payroll proof references after their allowed verification window has passed.

Why This Matters

Proofs should not stay valid forever because stale payroll evidence can be replayed after policies, employees, or funding conditions have changed.

Suggested Files

• contracts/src/proofs.rs
• contracts/src/payroll.rs
• contracts/src/errors.rs
• contracts/tests/proof_expiry.rs

Tasks

• Define proof expiry fields in payroll verification records.
• Reject execution when proof expiry is earlier than the current ledger time.
• Allow fresh proof replacement before payroll settlement.
• Add tests for fresh proofs, expired proofs, and proof replacement.

Acceptance Criteria

• Expired proof references cannot execute payroll.
• Fresh replacement proofs are accepted before settlement.
• Errors are deterministic for SDK handling.
• Tests cover boundary expiry timing.

Coordination

Join the Telegram channel for proper coordination: https://t.me/zkpayroll