test(treasury): add asset registration and validation test suite

[Francis6-git]

Summary

Added focused integration test coverage for treasury asset registration and lifecycle management in payment_executor. While allowlist behavior was already present in the implementation, this change introduces dedicated tests for registration, metadata/status updates, asset disablement, default-deny enforcement, and audit event emissions.

Additionally, updates docs/treasury.md to formally document the asset lifecycle, state event contract, and privacy guidelines.

---

Changes Made

Treasury Asset Lifecycle Tests

Added comprehensive integration tests in contracts/payment_executor/tests/treasury_authorization_tests.rs:

• test_treasury_asset_registration_defaults_to_supported_token_only
  • Verifies the primary token configured during initialization is automatically allowlisted.
  • Ensures any unrelated, unconfigured asset is rejected by default.
  • Asserts that unsupported assets cannot become usable implicitly without administrative action.
• test_treasury_asset_registration_can_be_updated_and_disabled
  • Registers a new asset via set_asset_allowed(asset, true) and asserts it transitions to an allowed state.
  • Disables the active asset using set_asset_allowed(asset, false).
  • Verifies subsequent authorization attempts for the disabled asset fail as expected.
• test_treasury_asset_registration_emits_state_event
  • Asserts that each allowlist update emits exactly one event.
  • Validates the event topic matches TreasuryAssetAllowedUpdated.
  • Confirms event payload data contains the target asset address, the updated allowlist boolean state, and the corresponding ledger timestamp.

Existing test test_unsupported_asset_rejection continues to pass, ensuring payment execution aborts with Asset not allowed when targeted assets are disabled.

Documentation

Updated docs/treasury.md with:

• Rules for asset registration, updates, and disablement.
• Clarification on default-deny behavior for unregistered/unknown assets.
• Specifications for the TreasuryAssetAllowedUpdated event contract.
• Privacy directives emphasizing that asset configuration events must strictly exclude payroll amounts, employee identifiers, or zk-proof data.
• Integration test coverage summary for contributors and auditors.

---

Behavior Covered

The contract enforces the following asset state machine:

1. Initialization: The primary payroll token configured at contract deployment is enabled automatically.
2. Default Deny: Unregistered/unknown assets are blocked by default.
3. Registration: Contract administrators can explicitly register and enable target assets.
4. Disablement: Previously allowed assets can be disabled dynamically.
5. Pre-execution Gate: Payment execution halts prior to processing if the specified asset is disabled or unregistered.
6. Audit Trail: Every configuration change emits a TreasuryAssetAllowedUpdated event.

---

Privacy & Security Considerations

All added test cases utilize mock generated addresses (Address::generate(&env)). In accordance with protocol guidelines, no employee identities, salaries, payment allocations, commitments, or zero-knowledge proof data are included in event assertions or documentation examples.

---

Verification & QA

Ran formatting and static analysis checks:

cargo fmt --all -- --check
cargo check -p payment_executor

Executed the targeted integration test suite:

cargo test -p payment_executor --test treasury_authorization_tests

Closes #267

[edehvictor]

@Francis6-git kindly fix CI

[Francis6-git]

@Francis6-git kindly fix CI

Please check again

[github-actions]

@Francis6-git this PR currently has merge conflicts.

Please resolve the conflicts before it can be merged automatically.