Implement full MVP: auth, HD wallet, Electrum client, deposits, bets, round/draw engine, payout, withdrawals, RBF, admin+audit

All 10 build-order stages complete and unit-tested (49 tests). Verified live on
mainnet: registration/address derivation, deposit crediting, a real 10 PLM bet
(broadcast + confirmed + change credited). A full round close->draw->payout
cycle was triggered live and was in progress at commit time. Withdrawal and RBF
bump are unit-tested but not yet exercised against a live broadcast. Known gaps
(scheduler doesn't resume mid-flight rounds after restart, payout has no retry,
no deployment setup, etc.) are documented in CLAUDE.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/electrum_smoke_test.py

@@ -0,0 +1,27 @@
+"""Manual smoke test: connect to the configured Electrum server, do the
+server.version handshake, subscribe to headers and confirm a sane tip height.
+
+Usage: PYTHONPATH=. python scripts/electrum_smoke_test.py
+"""
+
+import asyncio
+
+from app.config import settings
+from app.electrum.client import ElectrumClient
+
+
+async def main() -> None:
+    client = ElectrumClient(settings.electrum_host, settings.electrum_port, settings.electrum_use_ssl)
+    await client.connect()
+    print("connected + handshake OK")
+
+    header = await client.subscribe_headers()
+    print("tip:", header)
+    assert header["height"] > 0
+
+    await client.close()
+    print("OK")
+
+
+if __name__ == "__main__":
+    asyncio.run(main())

scripts/generate_master_key.py

@@ -0,0 +1,16 @@
+"""One-time ops bootstrap: generate and encrypt the server's master xprv.
+
+Usage:
+    python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+    # put that value in XPRV_ENCRYPTION_KEY (.env), then:
+    python scripts/generate_master_key.py
+"""
+
+from app.config import settings
+from app.wallet.hd import generate_master_key
+
+if __name__ == "__main__":
+    if not settings.xprv_encryption_key:
+        raise SystemExit("XPRV_ENCRYPTION_KEY is not set")
+    generate_master_key()
+    print(f"Master key written (encrypted) to {settings.master_key_path}")