Make the draw a commit-reveal at a fixed, confirmed, quorum-agreed height with a public proof (B-73, RND-14 … RND-20, RND-33 … RND-37, DAT-61 … DAT-66, API-25, API-45, AUD-24 … AUD-27, AUD-37, ELC-15, SEC-56, ADR-24, ADR-25)

The seed was the hash of the first block seen after the close, so a miner holding tickets
could withhold blocks until one made them win, the active Electrum server could pick which
real block was used by not announcing another (a failed corroboration even moved the draw to
the next block), and the participant order was the server-only `broadcast_at` with no
tie-break, so nobody could recompute the result.

- Open: every round gets a 32-byte `server_seed`, stored only Fernet-encrypted with the
  master-xprv key (`server_seed_enc`), with its published `server_seed_hash`;
  `draw_confirmations` is copied from round_config. The plaintext column is written only by
  the reveal.
- Entering `drawing` (one transaction, `draw_committed` audit row): participants ordered by
  bet txid, each `draw_position`, `participants_hash` (sha256 of `txid:vout:address\n`
  lines; new `bet_vout`), `draw_height = tip_at_close + 1`. A tip of 0 keeps the round
  `closing` (`draw_baseline_tip_unknown`, once per round). All persisted, so a resumed draw
  reads rather than recomputes (the `_tick` branch itself is B-81).
- `_complete_draw` / `_wait_for_draw_block` replace `_wait_for_next_block`: wait for
  `draw_confirmations` blocks from `draw_height`, then `ElectrumListener.agreed_block_hash`
  asks every server, the active one included, for the header at that exact height (valid
  work, >= 2 other answers, strict majority of all); no agreement means the same height is
  asked again and `draw_header_corroboration_failed` is written once per distinct reported
  hash. `draw_stalled` now counts from the last tip advance, or from when the quorum started
  to fail. Seed = sha256(server_seed || block_hash || participants_hash), index = seed mod n.
- The winner, the seed and the reveal (`server_seed`, `winner_drawn` payload) are written in
  one transaction; a round closing with no participants reveals too. A round opened before
  this change (no commitment) is given a secret as it enters `drawing`.
- `GET /rounds/{id}/proof` (public, 404 `round_not_found`, translated in all 7 languages) and
  the new fields on `GET /rounds/current`; `draw_confirmations` in `/admin/config` and the
  /admin form; `server_seed_hash`/`draw_height` in `/admin/rounds`, never the secret.
- Alembic d3e8b15a7c42 (plain add_column / create_index, expression indexes untouched).
- Docs: the B-73 `*Stato:*`/`*Oggi:*` lines are gone, guides and CLAUDE.md describe the new
  draw. Ambiguities resolved in api.md: the proof's participants also carry `amount_sats`
  (RND-37 lists it); `seed` is decimal in the proof and hex in the audit row, as specified.

Tests changed because the spec changed: ElectrumListener.corroborate_header (asked only the
other servers about the block the active one announced) is replaced by agreed_block_hash and
its quorum tests ported; draw_winner takes the secret and the list fingerprint; the four
_wait_for_next_block scheduler tests are replaced by _wait_for_draw_block ones (fixed height,
confirmations, same-height retry, stall clock). New: test_draw_proof.py recomputes the winner
independently from the public proof, checks the plaintext secret is nowhere in the database,
the API or the log before the reveal, and that a second pass over a `drawing` round yields
the same winner. Mutation-checked: ordering by broadcast_at, an early reveal and asking the
tip instead of the draw height each fail tests.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

app/electrum/listener.py

@@ -542,8 +542,8 @@ class ElectrumListener:
         agrees: Callable[[object], bool],
         description: str,
     ) -> bool:
-        """Shared quorum logic behind corroborate_header (B-28) and
-        corroborate_utxo_spent (B-29): ask every *other* configured server (never
+        """Shared quorum logic behind
+        corroborate_utxo_spent (B-29), credits and reinstatements: ask every *other* configured server (never
         the currently active one — that's exactly what a hostile server or a MITM
         would control) and require a strict majority of the ones that actually
         answer to agree, via `agrees`, with what our own connection reported.
@@ -749,33 +749,50 @@ class ElectrumListener:
         txid, votes = counts.most_common(1)[0]
         return txid if votes * 2 > len(answered) else None
 
-    async def corroborate_header(self, height: int, expected_hash: str) -> bool:
-        """B-28: is `expected_hash` — the header our own active connection
-        reported for `height` — corroborated by other configured servers before
-        the draw (rounds/scheduler.py:_wait_for_next_block) treats it as
-        trustworthy entropy? Without this, a single hostile server (or a MITM on
-        the one active connection) can single-handedly decide who wins every
-        round; this raises the bar to controlling a majority of the configured
-        servers. See _corroborate_majority for the shared quorum logic.
+    async def agreed_block_hash(self, height: int) -> tuple[str | None, str | None]:
+        """B-73 (RND-16, ELC-15): the hash of the block at exactly `height` — the draw's
+        entropy — as the *quorum* agrees on it, and what the active server said about it.
+
+        The header at that height (`blockchain.block.header`) is asked of every configured
+        server, the active one included, each over its own connection and within ELC-14's
+        timeouts. A header only counts if it is 80 bytes of valid work (ELC-11). The hash is
+        returned only when at least the quorum minimum of the *other* servers answered and a
+        strict majority of everybody who answered names the same one; otherwise the first
+        element is None and the caller asks again for **the same height** — the draw never
+        moves to a different block, so whoever relays blocks cannot pick one. The second
+        element is the active server's own answer (None if it gave none), for the audit row
+        written on a disagreement.
+
+        The old rule asked only the *other* servers to confirm the block the active one had
+        announced first after the close, which still let the active server choose which real
+        block seeded the draw simply by never announcing another.
         """
 
-        async def _ask(endpoint: ElectrumEndpoint) -> str | None:
-            client = self._client_factory(endpoint)
-            try:
-                await asyncio.wait_for(client.connect(), timeout=_CORROBORATION_TIMEOUT_SECONDS)
-                result = await asyncio.wait_for(
-                    client.request("blockchain.block.header", [height]),
-                    timeout=_CORROBORATION_TIMEOUT_SECONDS,
-                )
-                if not isinstance(result, str):
-                    return None
-                return header_hex_to_block_hash(result)
-            except Exception:
+        async def _ask(client: ElectrumClient) -> str | None:
+            header = await client.get_block_header(height)
+            if not isinstance(header, str) or not header_meets_its_own_target(header):
                 return None
-            finally:
-                await client.close()
+            return header_hex_to_block_hash(header)
 
-        return await self._corroborate_majority(_ask, lambda block_hash: block_hash == expected_hash, f"block {height} header")
+        answers = await self._ask_everyone(_ask)
+        reported = answers.active
+        if len(answers.answered_others) < self._minimum_other_answers():
+            logger.warning(
+                "block %s: %s of the other servers answered, %s needed", height, len(answers.answered_others),
+                self._minimum_other_answers(),
+            )
+            return None, reported
+        votes = Counter(answers.all)
+        if not votes:
+            return None, reported
+        block_hash, count = votes.most_common(1)[0]
+        if count * 2 <= len(answers.all):
+            return None, reported
+        if reported is not None and reported != block_hash:
+            logger.warning(
+                "block %s: the active server reported %s but the other servers agree on %s", height, reported, block_hash
+            )
+        return block_hash, reported
 
     async def corroborate_utxo_spent(self, scripthash: str, txid: str, vout: int) -> bool:
         """B-29: before deposits/service.py's find_utxos_missing_from candidates