Add test asserting config-key allowlist rejects unknown key writes #607

Description

Assert that any storage write to an unlisted config key fails with Error::ConfigKeyNotAllowed. Exercises the config allowlist introduced in wave 3.

Requirements and context

• Must be secure, tested, and documented
• Should be efficient and easy to review
• Relevant code: contracts/subscription_vault/src/admin.rs
• Test lives in contracts/subscription_vault/src/test_config_allowlist.rs

Suggested execution

• Fork the repo and create a branch
• git checkout -b tests/config-key-allowlist
• Implement changes
  • Attempt to write an unlisted key
  • Assert error kind
  • Confirm allowlist mutation path itself is admin-gated
• Validate security and correctness assumptions

Test and commit

• Run tests
  • cargo test --all
• Cover edge cases
  • Add-then-remove same key, key label with unicode edge cases, and permission escalation attempt
• Include test output and security notes

Example commit message

test: config allowlist rejects unknown keys

Guidelines

• Minimum 95 percent test coverage
• Clear documentation
• Timeframe: 96 hours