Give every payout a bump reserve output and refuse configs that cannot pay a round (B-79, RND-21, RND-23, RND-24, RND-27, RND-38, RND-40, DAT-73, API-31, API-36, TX-11, ADR-17, ADR-29)

The pool normally holds exactly the round's bet outputs and the payout spent them all for
exactly the pool amount, so it had no change output: bump_fee could never accelerate it,
and a payout stuck in a mempool (never abandoned while a server knows it) kept the round in
`paying_out` and the whole lottery stopped.

- build_payout_transaction always has three outputs: winner, fee address, and a bump reserve
  of max(DUST_LIMIT_SATS, estimate_vsize(inputs, 3) * 10 sat/vB) paid to the reserve address
  m/84'/746'/0'/1/0. The reserve comes out of the platform's 30%, the network fee still out
  of the winner's 70%. Input value beyond winner share + commission (only rounds opened
  before the per-round pool address) is folded into the reserve output if >= dust, left to
  the network fee otherwise. `change_address` is replaced by `reserve_address`.
- `rounds.bump_reserve_sats` (Alembic e5a91c3d7b26, plain add_column) is written with the
  payout intent before the broadcast; /admin/rounds returns it.
- bump_fee takes the increase from the reserve output for a payout
  (_find_reducible_output; a payout already in flight with a change to the pool still falls
  back to that), never from the winner or fee-address outputs.
- payout_config_problem / rounds_can_open (RND-40): a bet amount and fee rate under which a
  round of 1 or of MAX_PARTICIPANTS_PER_ROUND participants could not cover the network fee,
  the reserve and dust outputs opens no round (lottery_configured=false); PUT /admin/config
  refuses such a bet amount or fee rate with 422 config_not_payable, judged on the resulting
  values, since the payout reads the fee rate live.

Ambiguity resolved: the reserve output and any excess input are one output (RND-23 says one
output to the reserve address), and bump_reserve_sats records that output's initial value.
DAT-22's "abandon clears all amounts" stays with B-96.

Tests changed because the spec changed: the four test_payout_builder tests asserted the old
two/three-output shape with change to the pool and the fee address receiving the whole 30%;
the whitespace fee_address test now spells out the amounts rounds_can_open reads. New: reserve
sizing, payout with 1 and with 400 participants (inputs = outputs + fee to the satoshi),
exact commission/reserve/dust boundary, excess folded or left to the fee, a real payout bumped
out of its reserve with the other outputs byte-identical and bumped five times, the old
reserve-less shape still raising RbfError, the scheduler output addresses and recorded
amounts, payability boundaries found independently by bisection, no round / unconfigured flag
for an unpayable config, a round in progress surviving it, PUT /admin/config refusals and the
migration column. Mutation-checked: dropping the reserve lookup in bump_fee and the payability
check in rounds_can_open each fail tests.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

app/api/routes/admin.py

@@ -6,6 +6,7 @@ from pydantic import BaseModel, Field, field_validator
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.api.errors import http_error
 from app.api.timeutil import isoformat_utc
 from app.audit.log import write_audit_log
 from app.auth.security import hash_password_async
@@ -14,6 +15,7 @@ from app.db.models import AuditLog, BugReport, PendingTransaction, Round, User
 from app.db.session import get_session
 from app.rounds.config import get_round_config
 from app.rounds.pause import AUTOMATIC_REASONS, OPERATOR_REASON
+from app.rounds.service import payout_config_problem
 from app.wallet.address import is_valid_plm_address
 from app.wallet.hd import derive_user_wif
 from app.wallet.psbt_builder import MAX_FEE_RATE_SAT_VB
@@ -128,6 +130,21 @@ async def update_config(
         changes[field] = {"from": previous, "to": value}
         setattr(config, field, value)
 
+    # B-79 (RND-40): a bet amount or fee rate under which a round could not be paid out is
+    # refused before anything is written — the payout reads fee_rate_sat_vb at build time, so
+    # a rate raised mid-round could otherwise make the round in progress unpayable.
+    if "bet_amount_sats" in changes or "fee_rate_sat_vb" in changes:
+        problem = payout_config_problem(config.bet_amount_sats, config.fee_rate_sat_vb)
+        if problem is not None:
+            await session.rollback()
+            raise http_error(
+                422,
+                "config_not_payable",
+                "this bet amount and fee rate would make a round impossible to pay out "
+                f"({problem}); a larger bet amount or a lower fee rate is needed",
+                reason=problem,
+            )
+
     if changes:
         await write_audit_log(session, "config_updated", changes)
     await session.commit()
@@ -269,6 +286,7 @@ class AdminRoundResponse(BaseModel):
     pool_address: str | None  # B-80
     server_seed_hash: str | None  # B-73 (API-36): the commitment only — never the secret
     draw_height: int | None  # B-73
+    bump_reserve_sats: int | None  # B-79 (API-36)
 
 
 @router.get("/rounds", response_model=list[AdminRoundResponse], dependencies=[Depends(require_admin)])
@@ -299,6 +317,7 @@ async def list_rounds(
             pool_address=r.pool_address or None,
             server_seed_hash=r.server_seed_hash,
             draw_height=r.draw_height,
+            bump_reserve_sats=r.bump_reserve_sats,
         )
         for r in rounds
     ]