Move all business/round parameters into DB config, out of env entirely

RoundConfig gains round_duration_seconds, round_cooldown_seconds,
min_amount_sats, fee_rate_sat_vb and rbf_timeout_seconds (plus a
hardcoded default for the pre-existing bet_amount_sats) as column
defaults on the model itself — get_round_config no longer seeds from
Settings at all. Every call site that read these from settings
(scheduler, bets, withdrawals, rounds service/route, RBF bumper) now
reads the DB-backed RoundConfig instead.

app/config.py now holds only true env-driven infra/secrets (database
URL, Electrum connection, master key, JWT, admin token) — no business
parameter has an env var anymore, matching an explicit decision to drop
the "seed from settings" indirection entirely rather than keep a env
fallback nobody should rely on.

Migration backfills the existing round_config row via server_default
(matching the old settings defaults) then drops the default, so future
rows go through the ORM/model defaults instead of a stale constant.

Tests updated: should_bump's timeout_seconds is now required (no
settings fallback); test_scheduler.py seeds a RoundConfig row directly
instead of monkeypatching settings; test_withdrawals.py and
test_rounds_service.py use local constants mirroring the model
defaults instead of reading them off settings.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -17,5 +17,6 @@ JWT_SECRET=
 #   python -c "import secrets; print(secrets.token_urlsafe(32))"
 ADMIN_TOKEN=
 
-ROUND_DURATION_SECONDS=600
-ROUND_COOLDOWN_SECONDS=30
+# Every business/round parameter (bet amount, round duration/cooldown, min
+# amount, fee rate, RBF timeout, fee address) is configured live from the
+# admin panel (/admin) instead of here — see docs/guida-admin.md.