Decouple the RBF abandon clock from the bump clock (B-27)

bump_fee (tx/broadcast.py) used to overwrite PendingTransaction.
broadcast_at on every fee bump, but reconcile.py's abandon-after-N-
hours grace period is measured from that same column. A transaction
successfully bumped every rbf_timeout_seconds (900s by default) but
never mined reset that clock before it could ever reach the 6-hour
abandon window, so it was never abandoned: its UTXOs never returned to
the user, and if it was a bet the round stayed in "closing"
indefinitely.

PendingTransaction gains a last_broadcast_at column (migration
861e76aaf34c, backfilled from broadcast_at for existing rows before
the NOT NULL constraint is applied). broadcast_at is now never
rewritten after creation, so reconcile.py's _is_due keeps measuring
from the first broadcast unchanged. bump_fee updates last_broadcast_at
instead, and should_bump now reads last_broadcast_at rather than
broadcast_at — correct, since whether another bump is due should reset
after every bump, unlike the reconciler's abandon check, which must
not.

BUGS.md moves B-27 to "Previously fixed" with the fix description; the
suite grows from 148 to 151 tests, including a direct proof that a tx
bumped a minute ago but first broadcast 7 hours ago still gets
abandoned.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/tx/reconcile.py

@@ -129,6 +129,12 @@ async def reconcile_once(session_factory: async_sessionmaker, client: ElectrumCl
 
 
 def _is_due(row: PendingTransaction, now: datetime) -> bool:
+    # Deliberately broadcast_at (the *first* broadcast), not last_broadcast_at: an
+    # RBF bump used to overwrite this same field, which reset this grace period on
+    # every bump and meant a repeatedly-bumped-but-never-mined tx was never
+    # abandoned (B-27). tx/broadcast.py:bump_fee now only ever touches
+    # last_broadcast_at, so this keeps measuring from when the tx first appeared,
+    # no matter how many times it's since been bumped.
     grace = _BUILDING_GRACE_SECONDS if row.status == "building" else _ABANDON_AFTER_SECONDS
     return now >= row.broadcast_at.replace(tzinfo=timezone.utc) + timedelta(seconds=grace)