Verify the master key against the database at startup (B-89, SEC-49, SEC-50, SEC-09)

The lifespan decrypts the key and compares a fixed sample (reserve/round pool
addresses, the 10 lowest and highest user addresses, unrevealed round secrets)
with the database, and refuses to serve on any mismatch without printing key
material. The key scripts refuse a new or imported key that would not reproduce
the stored addresses, and write 0600.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

BUGS.md

@@ -102,16 +102,6 @@ decisions, see `docs/limiti-noti.md`):
 
 ## High
 
-### B-89 — Key problems surface only at first use
-
-Startup checks only that the key file exists and `XPRV_ENCRYPTION_KEY` is non-empty;
-a wrong key or a different xprv is found at the first registration or payout, and a
-different xprv silently moves the pool address. The scripts accept any xprv and write
-files `0644`.
-
-Fix: at startup decrypt the key and check the pool reserve address and a sample of
-stored user addresses; refuse to serve on mismatch. The scripts refuse an xprv whose
-derived addresses differ from the DB's and write `0600`.
 
 ### B-90 — Restoring a backup is unsafe