Fix the round-open race, the advertised jackpot, and payout error handling

Round opening (B-09). open_new_round_if_needed now handles the IntegrityError
from ix_rounds_single_active (previous commit) by rolling back and using the
winner's round. Deviation from the plan in BUGS.md, which proposed making the
scheduler the only writer: that would mean the first bet after a cooldown
couldn't open a round, so both callers stay and a bounded retry was added
instead — a conflict where nothing is active yet just means the winner hadn't
committed, and a bet must not fail on that timing. get_active_round also logs
loudly if it ever sees more than one active round rather than silently picking
the newest.

The jackpot (B-11). It was participant_count * the *current* bet_amount_sats,
which overstated the pool (each stored bet is already net of that bet's network
fee) and silently rewrote the advertised jackpot of a round in progress whenever
an operator edited the bet amount. It now sums the participants' stored
bet_amount_sats. The remaining imprecision — the payout tx's own fee, deducted
from the winner's share and unknowable until the payout is built — is documented
in the code rather than promised away, since the comment there claimed exactness.

Payout (B-05, B-18). _trigger_payout is split into read / build+broadcast /
persist, so no DB session is held across a network call (on SQLite that meant
holding the write lock for two unbounded round-trips). That restructuring is also
what makes the error handling placeable: it now catches Exception around the
chain work and writes a payout_failed audit entry, where a malformed fee_address
used to raise EmbitError all the way to the scheduler's catch-all, leaving the
round stuck in paying_out with nothing recorded about why. Automatic payout retry
remains an open gap.

The scheduler also counts "building" participants as in-flight when deciding
whether a round may close, matching the two-phase bet write.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/api/routes/rounds.py

@@ -118,6 +118,16 @@ async def current_round(
     participant_count = await session.scalar(
         select(func.count()).select_from(RoundParticipant).where(RoundParticipant.round_id == round_.id)
     ) or 0
+    # The pool is the sum of what the participants' bets actually paid into the pool
+    # address — each one is already net of that bet's network fee. Deriving it from
+    # participant_count * the *current* bet_amount_sats instead overstated it, and
+    # silently changed the advertised jackpot of a round in progress whenever an
+    # operator edited the bet amount (B-11).
+    pool_amount_sats = await session.scalar(
+        select(func.coalesce(func.sum(RoundParticipant.bet_amount_sats), 0)).where(
+            RoundParticipant.round_id == round_.id
+        )
+    ) or 0
     opened_at = round_.opened_at.replace(tzinfo=timezone.utc)
     closes_at = opened_at + timedelta(seconds=config.round_duration_seconds)
 
@@ -137,10 +147,11 @@ async def current_round(
 
     await session.commit()
 
-    # Shown to players as "jackpot": the winner's 70% share of the pool (same
-    # split rounds/scheduler.py applies at payout time), not the full pool —
-    # what's displayed should match what the winner actually receives.
-    pool_amount_sats = participant_count * config.bet_amount_sats
+    # Shown to players as "jackpot": the winner's 70% share of the pool (same split
+    # rounds/scheduler.py applies at payout time), not the full pool. It remains an
+    # upper bound by the payout tx's own fee, which is deducted from the winner's
+    # share and isn't knowable until the payout is built — a few hundred sat on a
+    # 1 sat/vB payout, i.e. invisible at PLM amounts, but it is not exact.
     jackpot_sats = pool_amount_sats * 70 // 100
 
     return CurrentRoundResponse(