core: add timelocked multisig recovery to parameters-contract

[EmeditWeb]

Problem

configure_multisig() in parameters-contract can only be called ONCE (lib.rs:46-48 has if storage::has_multisig(&env) check). If signer keys are lost, the only recovery path is through a proposal from the existing multisig — creating a circular dependency.

What To Build

1. Add an escape hatch: after a timelock delay (30 days + multisig signatures), the admin can reconfigure multisig
2. Or: store a separate recovery key that can reset multisig

Files To Touch

• contracts/parameters-contract/src/lib.rs
• contracts/parameters-contract/src/storage.rs
• contracts/parameters-contract/src/types.rs

Acceptance Criteria

• Multisig recovery path exists
• Recovery has timelock delay
• Requires admin or recovery key
• All existing tests pass

Mandatory Checks

• context/ files read
• cargo build passes
• cargo test passes
• PR references this issue

[demonchant]

I've reviewed the parameters-contract implementation and understand the root cause of this issue. The current configure_multisig() is intentionally one-shot, but that creates a circular dependency where lost multisig keys permanently lock governance because only the existing multisig can authorize a replacement.My approach is to implement a secure recovery path by introducing a recovery flow with a 30-day timelock. The recovery will require authorization from the admin (or a dedicated recovery key if preferred by the maintainers), record the initiation timestamp in contract storage, and only allow multisig reconfiguration once the timelock has fully elapsed. This preserves the existing governance model while providing a safe escape hatch for catastrophic key loss.I've already inspected the relevant files (contracts/parameters-contract/src/lib.rs, storage.rs, and types.rs) and understand where the new storage, recovery state, and validation logic should be integrated. I'll ensure the implementation is backward compatible, passes cargo build and cargo test, includes appropriate tests for the timelock behavior, and references this issue in the PR.