Confirm pending admin key rotation expiry handling

[nanaf6203-bit]

Problem Statement

Lending rotation rejections on expired requests may not properly clean up state.

Why it matters

State hygiene.

Technical Context

Audit plus confirm test in tests/lib.rs covers confirm-after-expiry.

Expected Outcome

Expired pending rotations are pruned and audit-logged.

Acceptance Criteria

1. cargo test includes expiry case.
2. Kani harness.
3. Doc note.

Implementation Notes

Test-side coverage.

Files or modules likely to be affected

contracts/traits/src/access_control.rs, contracts/lending/src/lib.rs.

Dependencies

None.

Difficulty level

EASY.

Estimated effort

S (~1 hour).