Cap the number of inputs a transaction may spend (B-48)

select_utxos had no ceiling on input count, so an address fragmented into many
small deposits built an ever-larger transaction whose fee — deducted from the
amount being moved — eroded the bet's share of the pool or the withdrawn amount,
and past a few hundred inputs stopped being standard at all.

MAX_TX_INPUTS (50) now bounds the selection. Reaching the cap without covering
the target is reported as its own "too_many_inputs" code, distinct from having
no funds, with the cap carried in the error params for the 7 translations. The
payout path records the same distinction in its payout_failed audit reason.

tests/unit/test_psbt_builder.py

@@ -5,6 +5,7 @@ from embit.transaction import Transaction
 
 from app.wallet.plm_network import PLM_MAINNET
 from app.wallet.psbt_builder import (
+    MAX_TX_INPUTS,
     InsufficientFundsError,
     Utxo,
     build_signed_transaction,
@@ -36,6 +37,22 @@ def test_select_utxos_raises_when_insufficient():
         select_utxos(utxos, target_sats=10_000_000)
 
 
+def test_select_utxos_never_exceeds_the_input_cap(): # B-48
+    # 200 dust-ish UTXOs that together cover the target, but only past the cap.
+    utxos = [Utxo(f"{i:064x}", 0, 100_000) for i in range(200)]
+    with pytest.raises(InsufficientFundsError) as excinfo:
+        select_utxos(utxos, target_sats=100_000 * MAX_TX_INPUTS + 1)
+    assert excinfo.value.code == "too_many_inputs"
+    assert excinfo.value.params == {"max_inputs": MAX_TX_INPUTS}
+
+
+def test_select_utxos_allows_exactly_the_input_cap():
+    utxos = [Utxo(f"{i:064x}", 0, 100_000) for i in range(200)]
+    selected, total = select_utxos(utxos, target_sats=100_000 * MAX_TX_INPUTS)
+    assert len(selected) == MAX_TX_INPUTS
+    assert total == 100_000 * MAX_TX_INPUTS
+
+
 def test_build_signed_transaction_deducts_fee_from_amount_not_change():
     signer = _key(1)
     from_script = script.p2wpkh(signer.to_public())