security: add ownership verification to contract state transitions

[BossChaos]

Summary

Fixes #3217 — HIGH severity: unauthorized contract state changes possible.

Changes

• Require X-Agent-Key header for contract state updates
• Verify caller is from_agent or to_agent of the contract
• Validate state transitions to prevent arbitrary jumps
• Only to_agent can accept contracts (offered → active)
• Only from_agent can mark contracts as breached
• Terminal states (completed/breached/expired) cannot be modified

Fix Details

File: node/beacon_api.py

Before the fix, the /api/contracts/<contract_id> PUT endpoint allowed anyone to change contract state to any value without authentication or validation.

The fix adds:

1. State transition validation — only valid transitions allowed (offered→active→completed, etc.)
2. Terminal state protection — completed/breached/expired contracts cannot be modified
3. Party verification — only contract participants can update state
4. Role-based restrictions — only recipient can accept, only creator can breach

Impact

• Prevents unauthorized state transitions on any contract
• Maintains proper contract lifecycle integrity
• No breaking changes for legitimate contract participants

[Scottcjn]

Paid: 15 RTC. pending_id 1373, tx 16a51ea7f3f9ab92eed5d07c50e6221f. ownership verification on contract state transitions (#3217) — HIGH severity

Merging.