Never roll back an ambiguous broadcast as if it had been refused (B-76, TX-04, TX-05, TX-20, TX-21, BET-16, BET-17, BET-23, WDR-11, WDR-12, WDR-16, API-13)

place_bet and request_withdrawal released everything on any exception from the
broadcast, including the 15s timeout and a connection dropped after the write. The
tx may have propagated: a bet's sats landed in the pool with no participant, a
withdrawal left while its row said failed and its coins were spendable again.

- client: ElectrumRpcError (subclass of ElectrumError) is raised only for a reply
  carrying a JSON-RPC `error`; timeouts, drops and write errors stay plain
  ElectrumError.
- tx/outcome.py:broadcast_with_verdict sorts a broadcast into accepted / refused /
  uncertain. A refusal is verified first: ElectrumListener.transaction_known asks
  blockchain.transaction.get of the active server and every other one (10s each) —
  any server returning the tx means accepted; the active server plus
  MIN_QUORUM_RESPONSES others all denying it means refused (ALLOW_NO_QUORUM keeps
  the reduced rule); too few answers is uncertain. "already known" wording is only a
  shortcut that skips the check. With no network to ask, a refusal is uncertain.
- place_bet / request_withdrawal / _trigger_payout use it: only a verified refusal
  releases; uncertain leaves the rows building for the reconciler, publishes SSE and
  POST /bets and POST /withdrawals answer 202 with status building; "already known"
  promotes a payout (payout_sent) like any accepted broadcast.
- An accepted transaction is fanned out to every other server
  (ElectrumListener.fan_out_transaction, best effort, off the caller's path). The RBF
  replacement in bump_fee is left for B-77, which rewrites that function.

Tests changed because the spec changed: the existing "refused broadcast" tests raised
a bare RuntimeError (now an uncertain outcome) and are made explicit refusals
(rpc_error) with a network that denies the tx; direct route calls pass a Response;
FakePayoutListener gains the network surface.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/unit/test_bets.py

@@ -12,6 +12,7 @@ from app.rounds.events import broadcaster
 from app.rounds.service import open_new_round_if_needed
 from app.wallet.hd import derive_user_address
 from app.wallet.psbt_builder import MAX_PARTICIPANTS_PER_ROUND, MAX_TX_INPUTS
+from tests.unit.fake_network import FakeNetwork, rpc_error
 
 
 _FEE_ADDRESS = "plm1q5x25wd6q463mfhckjraaedgjg0lyu73qfcj43n"
@@ -250,7 +251,7 @@ class RejectingElectrumClient:
     conflict, or simply an unreachable server."""
 
     async def broadcast(self, raw_tx_hex: str) -> str:
-        raise RuntimeError("min relay fee not met")
+        raise rpc_error("min relay fee not met")
 
 
 async def test_failed_broadcast_leaves_nothing_behind(session_factory):
@@ -262,7 +263,7 @@ async def test_failed_broadcast_leaves_nothing_behind(session_factory):
     async with session_factory() as session:
         user = await session.get(User, user_id)
         with pytest.raises(BetError, match="refused"):
-            await place_bet(session, RejectingElectrumClient(), user)
+            await place_bet(session, RejectingElectrumClient(), user, network=FakeNetwork(known=False))
 
     async with session_factory() as session:
         utxo = (await session.scalars(select(UtxoEvent).where(UtxoEvent.user_id == user_id))).one()
@@ -296,7 +297,7 @@ async def test_failed_broadcast_publishes_an_sse_update(session_factory):  # B-4
         async with session_factory() as session:
             user = await session.get(User, user_id)
             with pytest.raises(BetError, match="refused"):
-                await place_bet(session, RejectingElectrumClient(), user)
+                await place_bet(session, RejectingElectrumClient(), user, network=FakeNetwork(known=False))
 
         assert not queue.empty()
     finally:
@@ -309,7 +310,7 @@ async def test_failed_broadcast_reports_the_broadcast_failed_code(session_factor
     async with session_factory() as session:
         user = await session.get(User, user_id)
         try:
-            await place_bet(session, RejectingElectrumClient(), user)
+            await place_bet(session, RejectingElectrumClient(), user, network=FakeNetwork(known=False))
             assert False, "expected BetError"
         except BetError as exc:
             assert exc.code == "broadcast_failed"