Corroborate deposit credits, not just external spends (B-59)

A candidate external spend has needed a quorum since B-29, but `value` and
`height` for a *credit* came from the single active connection and went straight
into utxo_events. One hostile or broken server could therefore inflate a user's
displayed balance with outpoints that don't exist. It never spends anyone else's
coins — a bet or withdrawal built on a phantom UTXO is refused at broadcast and
rolled back — but it wedges the balance display and burns build attempts, and on
a custodial platform a balance that isn't real is a support incident either way.
Balances move in both directions; both directions now need the same quorum.

corroborate_utxo_credit asks the other configured servers whether they report
the same outpoint, for the same amount, confirmed. The height itself isn't
compared: a server still catching up reports height 0 and simply doesn't agree,
which is the same answer, while two honest servers can't disagree on the height
of a genuinely confirmed outpoint.

refresh_user gains the phase that shape already implied: find_new_credit_
candidates (new, confirmed, not already held) inside the first session,
corroboration outside any session, then credit_confirmed_utxos over what
survived. Only new outpoints are corroborated — re-checking what we already hold
would open a connection to every other server on every refresh for an answer
that can no longer change anything.

A failed corroboration delays a credit, it never loses one: the next scripthash
notification or DepositReconciler sweep (300s) re-offers the same outpoint, and
the withholding is logged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/deposits/service.py

@@ -11,6 +11,32 @@ from app.wallet.balance import recompute_balance
 logger = logging.getLogger(__name__)
 
 
+async def find_new_credit_candidates(session: AsyncSession, user_id: int, entries: list[dict]) -> list[dict]:
+    """The subset of `entries` that would actually credit something: confirmed
+    (height > 0, per the Electrum convention where <= 0 means mempool) and not
+    already recorded.
+
+    Split out from credit_confirmed_utxos so the caller
+    (electrum/listener.py:refresh_user) can corroborate each *new* outpoint
+    against the other configured servers before any of it is written (B-59) —
+    the mirror image of what B-29 already required before a balance may go
+    *down*. Only new ones: corroborating outpoints already credited would open a
+    connection to every other server on every refresh, for an answer that can no
+    longer change what we hold.
+    """
+    existing_keys = {
+        (txid, vout)
+        for txid, vout in (
+            await session.execute(select(UtxoEvent.txid, UtxoEvent.vout).where(UtxoEvent.user_id == user_id))
+        ).all()
+    }
+    return [
+        entry
+        for entry in entries
+        if entry["height"] > 0 and (entry["tx_hash"], entry["tx_pos"]) not in existing_keys
+    ]
+
+
 async def credit_confirmed_utxos(session: AsyncSession, user_id: int, entries: list[dict]) -> int:
     """Insert utxo_events for newly-confirmed entries from an Electrum
     `listunspent` response (idempotent on txid+vout), refresh the user's cached