Cap the number of inputs a transaction may spend (B-48)

select_utxos had no ceiling on input count, so an address fragmented into many
small deposits built an ever-larger transaction whose fee — deducted from the
amount being moved — eroded the bet's share of the pool or the withdrawn amount,
and past a few hundred inputs stopped being standard at all.

MAX_TX_INPUTS (50) now bounds the selection. Reaching the cap without covering
the target is reported as its own "too_many_inputs" code, distinct from having
no funds, with the cap carried in the error params for the 7 translations. The
payout path records the same distinction in its payout_failed audit reason.

app/withdrawals/service.py

@@ -89,7 +89,7 @@ async def request_withdrawal(
             fee_rate_sat_vb=config.fee_rate_sat_vb,
         )
     except InsufficientFundsError as exc:
-        raise WithdrawalError(exc.code, str(exc)) from exc
+        raise WithdrawalError(exc.code, str(exc), **exc.params) from exc
 
     # Persist the intent before broadcasting, and only promote the rows once the
     # network has accepted the tx — same two-phase shape as place_bet (B-08).