CLPR-6.1: ClprService Proxy, Access Control, and Deployment Scaffold

## Story CLPR-6.1: ClprService Proxy, Access Control, and Deployment Scaffold

**Parent Epic:** CLPR-6: Ethereum On-Chain Service
**Repo:** TBD

### Objective

Deploy the EIP-1967 transparent proxy infrastructure with role-based access control and upgrade scripts.

### Acceptance Criteria

- **AC-1:** `ClprServiceProxy` (EIP-1967) delegating to `ClprService` implementation.
- **AC-2:** `ProxyAdmin` owned by `TimelockController` (48+ hour delay for mainnet).
- **AC-3:** `DEFAULT_ADMIN_ROLE` grants/revokes roles. `ADMIN_ROLE` gates config and governance.
- **AC-4:** `setClprEnabled(bool)` gated by ADMIN_ROLE. When disabled, non-admin functions revert.
- **AC-5:** Deployment script: proxy, implementation, ProxyAdmin, TimelockController, role config.
- **AC-6:** Upgrade script: new implementation via TimelockController.
- **AC-7:** Storage layout documented (no proxy slot collisions).
- **AC-8:** Foundry tests: deployment, upgrade, role enforcement, enable/disable.

### Dependencies

- OpenZeppelin Contracts

### Risk

**Low** — Well-established patterns. Storage layout discipline critical for upgrades.

Start by locating the Solidity contract and Foundry project entry points for ClprService, then review the OpenZeppelin proxy, access-control, and timelock patterns. Done means the proxy, role configuration, deployment and upgrade scripts, storage-layout documentation, and Foundry tests satisfy acceptance criteria AC-1 through AC-8.

Written by the indexing model from the issue text.