Track every version of a bumped transaction and write the RBF replacement before broadcasting it (B-77, TX-12, TX-13, TX-19, TX-21, DAT-13, DAT-14, DAT-34, DAT-44, DAT-45, DAT-70, DAT-71)

The poller and the reconciler matched current_txid only. If an earlier version of
a bumped transaction confirmed it was never seen, and after 6h the row was abandoned:
a confirmed bet's participant deleted, a sent withdrawal marked failed, a paid payout
rebuilt. bump_fee also broadcast in phase 2 and persisted in phase 3 unconditionally,
so a crash or a `database is locked` in between left a transaction on the network that
the DB did not know, and an abandon or a confirmation in the meantime was overwritten.

- New table pending_transaction_txids (migration a3f5c2d9b7e1; txid unique, index on
  the owning row; existing rows backfilled with current_txid + raw and the txid their
  last bump replaced, raw_hex empty). Written with the row by place_bet,
  request_withdrawal and _trigger_payout; removed with a bet row that a verified
  refusal deletes (DAT-38).
- bump_fee in four phases: read, build and sign, commit the replacement as a candidate
  version, broadcast (verdict of B-76, fanned out when accepted; an explicit refusal
  raises RbfError and leaves the row), then switch the row over with
  `UPDATE ... WHERE status='pending' AND current_txid=<replaced>`. Zero rows matched is
  a logged conflict: nothing is overwritten and the candidate stays recorded. An
  uncertain broadcast adopts the replacement. A retry rebuilds the same candidate
  without tripping the unique txid.
- poll_once and reconcile_once look for every txid of a row. When the version found is
  not the current one, broadcast.adopt_version makes it current (raw tx included) and
  retargets spent_txid, bet_txid, withdrawals.txid and payout_txid as a bump does,
  before the confirmation handler runs. _release_inputs frees inputs claimed by any
  version of the row.
- RbfBumper takes the listener as `network`.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

app/db/models.py

@@ -200,6 +200,27 @@ class PendingTransaction(Base):
     updated_at: Mapped[datetime] = mapped_column(default=utcnow, onupdate=utcnow)
 
 
+class PendingTransactionTxid(Base):
+    """Every version a PendingTransaction has ever had (B-77, DAT-70, DAT-71): the first
+    one, each RBF replacement and each candidate written before a bump is broadcast.
+
+    The network may confirm *any* of them — the original while a bump was in flight, a
+    replacement the process crashed before recording — so the poller and the reconciler
+    look for every txid of a row, not only `current_txid`. Rows are never modified or
+    deleted (except with the `bet` row `_release_failed_bet` removes); `txid` is unique
+    over the whole table, so a txid belongs to exactly one platform transaction.
+    `raw_hex` is empty only for a `replaced_by_txid` reconstructed by the migration,
+    whose raw transaction is no longer available."""
+
+    __tablename__ = "pending_transaction_txids"
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    pending_transaction_id: Mapped[int] = mapped_column(ForeignKey("pending_transactions.id"), index=True)
+    txid: Mapped[str] = mapped_column(String(64), unique=True)
+    raw_hex: Mapped[str] = mapped_column(Text)
+    created_at: Mapped[datetime] = mapped_column(default=utcnow)
+
+
 class Withdrawal(Base):
     __tablename__ = "withdrawals"