[CHKM001]

PR #45 feat: add a per-jar pause switch

Summary

A creator mid-way through changing collaborators, or dealing with a dispute over
how a jar is split, previously had no way to stop tips arriving while they sort
it out — the only options were to leave the jar accepting money on terms that
may be wrong, or to abandon the slug entirely.

This adds a per-jar pause flag so the owner can close a jar temporarily
without losing it. Tips are rejected while paused with a typed error; every read
stays available throughout.

Changes

Contract (contracts/tip-splitter/src/lib.rs)

• Added paused: bool to the Jar struct, alongside the existing locked
  field, so the flag is visible for free in the Jar that get_jar returns.
• set_jar_paused(jar_id, paused) — owner-only. A single function that both
  sets (true) and clears (false) the flag. Emits a jar_pause event
  carrying the new value.
• is_jar_paused(jar_id) -> bool — a cheap read of the flag, mirroring
  is_splits_locked. Panics with JarNotFound for an unregistered slug, like
  get_jar.
• Error::JarPaused = 39 — a new typed error, appended (no existing code
  renumbered).
• Enforcement lives in the shared private settle_tip, so every tip entry
  point — tip, tip_with_ref, tip_in_token, and each entry of tip_many —
  rejects a paused jar. The check runs after the jar is looked up and before
  any funds move, so a rejected tip transfers nothing.
• The flag is a property of the jar, not the owner, so it survives
  transfer_jar_ownership (same treatment as locked) and is carried through
  every Jar write path.
• Bumped INTERFACE_VERSION 4 → 5, per the rule that a new function or error
  code is a public-interface change.

Tests (contracts/tip-splitter/src/test.rs)

• paused_jar_rejects_tips_until_unpaused — a paused jar rejects tip,
  tip_in_token and tip_many with JarPaused and moves no funds; reads
  (get_jar, preview_split, is_jar_paused) stay available; unpausing
  restores normal settlement.
• set_jar_paused_is_owner_only — a non-owner cannot toggle the flag.
• jar_pause_emits_event_and_survives_ownership_transfer — the jar_pause
  event fires with the expected topics/data, the flag shows in get_jar, and it
  survives a handover to a new owner.
• Updated the version() pin (4 → 5) and completed the error-code pin table
  (added 37, 38, 39).

Docs (docs/CONTRACT.md)

• Jar type now lists paused; added function-table rows for
  set_jar_paused / is_jar_paused; added the jar_pause event, error code
  39, the per-jar check in the tip / tip_many error ordering, and a new
  "Pausing a jar (Add a per-jar pause switch so a creator can stop accepting tips #45)" section covering read-availability, survival across
  ownership transfer, and how it relates to the admin-wide pause.

Example (examples/tip-forwarder/src/lib.rs)

• Added paused to the Jar mirror, which decodes get_jar; its own comment
  requires the mirror to carry every field the real Jar stores (the XDR is a
  name-keyed map).

Acceptance criteria

• An owner-only function sets and clears a paused flag on a jar, and tipping
  a paused jar is rejected with a typed error (JarPaused).
• Tests cover tipping while paused, tipping after unpausing, and that only
  the owner can change the flag.
• The function, the flag's visibility in reads, and the new error are
  documented in docs/CONTRACT.md.

Testing

• cargo fmt --all -- --check — passes.
• The three new tests pass; the full tip-splitter suite is green for every
  path this change touches.

Note on this environment: the pinned 1.84.0-x86_64-pc-windows-msvc toolchain
could not link locally (no MSVC linker installed on the dev box), so the suite
was run on the stable-x86_64-pc-windows-gnu toolchain. Two unrelated
failures surfaced there (leave_jar_reassigns_departing_share_to_last_entry
and tip_writes_the_two_totals_entries); both reproduce identically on a
clean tree without this change (verified via git stash), so they are
pre-existing and independent of this PR. CI on the pinned toolchain is the
source of truth for the final green run.

Closes #45