Cap the number of inputs a transaction may spend (B-48)

select_utxos had no ceiling on input count, so an address fragmented into many
small deposits built an ever-larger transaction whose fee — deducted from the
amount being moved — eroded the bet's share of the pool or the withdrawn amount,
and past a few hundred inputs stopped being standard at all.

MAX_TX_INPUTS (50) now bounds the selection. Reaching the cap without covering
the target is reported as its own "too_many_inputs" code, distinct from having
no funds, with the cap carried in the error params for the 7 translations. The
payout path records the same distinction in its payout_failed audit reason.

app/rounds/scheduler.py

@@ -364,9 +364,12 @@ class RoundScheduler:
                 change_address=pool_address,
                 fee_rate_sat_vb=fee_rate,
             )
-        except InsufficientFundsError:
-            logger.exception("round %s payout failed: insufficient pool UTXOs", round_id)
-            await self._log_payout_failure(round_id, winner_user_id, "insufficient pool UTXOs")
+        except InsufficientFundsError as exc:
+            # Includes the B-48 "too_many_inputs" case: the pool holds enough, but spread
+            # over more UTXOs than one transaction may spend, so /admin has to say which.
+            reason = "insufficient pool UTXOs" if exc.code == "insufficient_balance" else exc.code
+            logger.exception("round %s payout failed: %s", round_id, reason)
+            await self._log_payout_failure(round_id, winner_user_id, reason)
             return
         except Exception:
             # Anything else — a malformed fee_address (EmbitError) or similar. This