Track every version of a bumped transaction and write the RBF replacement before broadcasting it (B-77, TX-12, TX-13, TX-19, TX-21, DAT-13, DAT-14, DAT-34, DAT-44, DAT-45, DAT-70, DAT-71)

The poller and the reconciler matched current_txid only. If an earlier version of
a bumped transaction confirmed it was never seen, and after 6h the row was abandoned:
a confirmed bet's participant deleted, a sent withdrawal marked failed, a paid payout
rebuilt. bump_fee also broadcast in phase 2 and persisted in phase 3 unconditionally,
so a crash or a `database is locked` in between left a transaction on the network that
the DB did not know, and an abandon or a confirmation in the meantime was overwritten.

- New table pending_transaction_txids (migration a3f5c2d9b7e1; txid unique, index on
  the owning row; existing rows backfilled with current_txid + raw and the txid their
  last bump replaced, raw_hex empty). Written with the row by place_bet,
  request_withdrawal and _trigger_payout; removed with a bet row that a verified
  refusal deletes (DAT-38).
- bump_fee in four phases: read, build and sign, commit the replacement as a candidate
  version, broadcast (verdict of B-76, fanned out when accepted; an explicit refusal
  raises RbfError and leaves the row), then switch the row over with
  `UPDATE ... WHERE status='pending' AND current_txid=<replaced>`. Zero rows matched is
  a logged conflict: nothing is overwritten and the candidate stays recorded. An
  uncertain broadcast adopts the replacement. A retry rebuilds the same candidate
  without tripping the unique txid.
- poll_once and reconcile_once look for every txid of a row. When the version found is
  not the current one, broadcast.adopt_version makes it current (raw tx included) and
  retargets spent_txid, bet_txid, withdrawals.txid and payout_txid as a bump does,
  before the confirmation handler runs. _release_inputs frees inputs claimed by any
  version of the row.
- RbfBumper takes the listener as `network`.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

app/bets/service.py

@@ -14,6 +14,7 @@ from app.electrum.client import ElectrumClient
 from app.rounds.config import get_round_config
 from app.rounds.events import broadcaster
 from app.rounds.service import open_new_round_if_needed, round_accepts_bets
+from app.tx.versions import delete_versions, record_version
 from app.tx.outcome import BroadcastOutcome, TransactionNetwork, broadcast_with_verdict
 from app.wallet.balance import recompute_balance
 from app.wallet.hd import derive_user_key
@@ -148,6 +149,7 @@ async def place_bet(
     session.add(participant)
     pending = _pending_transaction(round_.id, user.id, built, config.fee_rate_sat_vb)
     session.add(pending)
+    await record_version(session, pending, built.txid, built.raw_hex)  # B-77: the first version, with the row
 
     # B-53: the deadline check at the top of this function happened before the UTXO
     # scan and the signing above, so re-check it here against the clock as it is now —
@@ -258,6 +260,7 @@ async def _release_failed_bet(
         if row is not None:
             row.spent_txid = None
     await session.delete(participant)
+    await delete_versions(session, pending.id)  # B-77 (DAT-38): the versions go with the row
     await session.delete(pending)
     await recompute_balance(session, user_id)
     await write_audit_log(