Safe restore from a backup: START_PAUSED and the derivation-gap check (B-90, REG-15, OPS-27)

START_PAUSED=true pauses the lottery as the operator before the scheduler exists.
On the first Electrum session the 20 derivation indexes past the highest
assigned one are looked up on every server; if any has history, registration
stays closed (503 registration_unavailable) and restore_gap_detected is
written, so a restored database cannot hand a lost user's address to a new one.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs/modello-dati.md

@@ -844,10 +844,6 @@ senza riavviare (vedi [limiti-noti.md](limiti-noti.md)).
   `app/electrum/listener.py:ElectrumListener._record_reorg` ·
   `app/rounds/scheduler.py:RoundScheduler._trigger_payout` ·
   `app/tx/reconcile.py:reconcile_once` · *Test:* `tests/unit/test_pause_reason.py`, `tests/unit/test_electrum_listener.py`
-  *Stato:* da implementare (B-90) · *Oggi:* si scrivono
-  `operator` (`POST /admin/pause`), `resurrected_tx` (il riconciliatore),
-  `reorg` (il listener) e `payout_blocked` (lo scheduler); `START_PAUSED` non ha
-  ancora chi lo scrive.
 
 - **[DAT-31]** Con `fee_address` vuoto (o di soli spazi) non si apre nessun round
   (B-66). Una volta impostato, l'API non permette di svuotarlo di nuovo: la