Require a real Electrum quorum and allow certificate pinning (B-84, ELC-01, ELC-03, ELC-14, ELC-19, ARC-20, OPS-12)

An empty ELECTRUM_FALLBACK_SERVERS (the .env.example default) silently made every
corroboration pass, and with fallbacks the majority was taken over whoever
answered, so one reachable fallback decided alone. TLS certificates were never
checked.

- _corroborate_majority passes only with at least 2 answers (MIN_QUORUM_RESPONSES)
  and a strict majority of the answers; no other server configured, or fewer than
  2 answering, fails. ALLOW_NO_QUORUM=true keeps the old reduced rule.
- config.validate_quorum_servers, called from the lifespan after parse_endpoints,
  refuses to start with fewer than 2 fallback servers unless ALLOW_NO_QUORUM=true
  (which logs a warning at every start).
- Optional pinning: `host:port[:mode]:pin=<sha256>` per fallback and
  ELECTRUM_CERT_PIN for the primary; ElectrumClient compares the SHA-256 of the
  DER certificate after the TLS handshake and a mismatch fails like an unreachable
  server. A pin on a plaintext entry is a startup error.
- .env.example now ships the four bootstrap servers and documents both new
  variables; docs/setup.md, spec, storico and BUGS.md updated.
- Tests changed because the spec changed: the two "no other servers configured ->
  True" corroboration tests now assert that outcome only under allow_no_quorum.

Note: a dev .env with fewer than 2 fallback servers will now refuse to start.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

BUGS.md

@@ -237,16 +237,6 @@ Fix: a confirmation is accepted once the quorum returns a valid merkle proof
 (`blockchain.transaction.get_merkle`) against a header we hold; reinstatement needs
 the same quorum as a credit (B-59); broadcasts fan out (B-76).
 
-### B-84 — The quorum can be one server, or none, silently
-
-An empty `ELECTRUM_FALLBACK_SERVERS` (the `.env.example` default) disables every
-corroboration; with fallbacks, the majority is over whoever answers, so one reachable
-fallback decides. TLS certificates are not verified.
-
-Fix: at least 2 fallbacks and at least 2 responders for every corroboration, or the
-server refuses to start (override `ALLOW_NO_QUORUM=true`, development only); optional
-certificate pinning per endpoint (`host:port:pin=<sha256>`).
-
 ### B-85 — Reorgs are neither followed nor surfaced
 
 Nothing detects a reorg; a 1-block reorg is treated as a hostile server (B-74).