fixes issue 274

[razeprasine]

Summary

• Added regression test for buy_key against unregistered creator — test_buy_key_unregistered_creator_no_state_mutation in buy_key.rs verifies that calling buy_key with a creator address that was never registered reverts with ContractError::NotRegistered and leaves all contract state unchanged.
• Uses capture_snapshot + assert_unchanged to comprehensively assert no mutation to supply, holder count, or key balance on a separate registered creator after the failed call.
• Distinct from existing buy-quote-for-missing-creator tests (which test the read-only get_buy_quote path, not the state-mutating buy_key path).

Testing

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• cargo test --test buy_key — 4/4 passed (3 existing + 1 new)
  Checklist
• Linked issue or backlog item
• Added or updated creator-keys unit/integration tests for every changed contract behavior, including failure paths for new or reachable ContractError variants
• Ran cargo fmt --all -- --check, cargo clippy --workspace --all-targets -- -D warnings, and cargo test --workspace, or explained exactly why a command was not run
• Reviewed persistent storage changes against docs/storage-key-invariants.md; any storage layout change includes a migration/backward-compatibility note
• Confirmed event names, topic order, payload field order, and field meanings remain compatible with docs/contract-event-conventions.md, or documented the breaking change and versioning plan
• Updated docs for any changed public contract interface, read-only method, event schema, storage behavior, fee logic, or deployment workflow
• Scope stays limited to one contract concern and does not include unrelated formatting, lockfile, generated artifact, or dependency changes

Closes #275