Keep replaced withdrawals pending until their RBF replacement confirms

[markettes]

Stacked on #642.

What changes

A withdrawal request's status now only describes its own transaction. Creating, executing or abandoning an RBF replacement never writes the request it replaces; "replaced" is derived from the replacement through the existing BumpingWalletWithdrawalRequestId link, and Bumped becomes terminal: written only by the monitor once a replacement confirms.

Why: Bumped meant two things at once ("replacement in flight" and "superseded, done"), and that dual meaning is behind the bugs the RBF work keeps hitting. A bumped original was not polled, so its confirmation was only noticed through the replacement's row; whenever the replacement was abandoned without a revert (RPC MarkWithdrawalRequestCancelled, the UI's dismissed confirmation modal, a failed revert write) the original sat Bumped forever with a transaction that could still confirm, by-id clients saw WITHDRAWAL_BUMPED forever, and its inputs stopped counting as locked. The revert itself was the cross-row write Copilot kept flagging on #642.

Event	Original in DB	Original by gRPC id	Replacement
Replacement created (cold: awaiting approval)	OnChainConfirmationPending	WITHDRAWAL_PENDING_CONFIRMATION, replaced_by_request_id set	live
Replacement broadcast	untouched	WITHDRAWAL_BUMPED / WITHDRAWAL_CANCELLED (derived)	OnChainConfirmationPending
Replacement abandoned	untouched	WITHDRAWAL_PENDING_CONFIRMATION again	terminal
Replacement confirms	Bumped / Cancelled + reason, by the monitor	same	OnChainConfirmed
Original mined instead	OnChainConfirmed, the monitor polls it itself	WITHDRAWAL_SETTLED	Failed "Withdrawal request A was mined instead", every replacement, a cold one awaiting approval included

• Model: Replacements navigation, EffectiveStatus() (single derivation point for the RPC and the Withdrawals page), LiveReplacement / BroadcastReplacement. The AutoMapper self-map ignores both RBF navigations so Repository.Update never writes a neighbour.
• One live replacement per request: service guard plus partial unique index IX_WalletWithdrawalRequests_LiveReplacement; the loser of a race gets FAILED_PRECONDITION, not INTERNAL.
• Monitor: null-safe NBXplorer result, per-row errors instead of aborting the batch, a floor of one confirmation (replaced originals are polled again and an evicted one sits at 0), then ReconcileReplacementChainsAsync gives each live linked row its final status from the database alone. Each row writes only itself, so a failed write is retried next run. Path rule: a bump of a cancellation still cancels the first original.
• gRPC: GetWithdrawalsRequestStatusByReferenceIds now returns every request carrying the reference id, oldest first, each with its own status. WithdrawalRequest gains replaced_by_request_id (newest non-abandoned replacement, set even while awaiting approval). WITHDRAWAL_BUMPED stays, derived while in flight, stored once settled.
• UI: bump / cancel gated on "pending and no live replacement", status cell shows the stored status plus "replaced by #N" (the page has no NBXplorer input, so it does not derive); the mark / revert paths are gone.
• Removed: MarkOriginalAsReplacedAsync, RevertOriginalAsync, SettleMinedOriginalAsync, the "Cancelled by RBF replacement request" marker comparison.

Migration BumpedIsTerminalOnly

Repairs legacy rows in SQL before creating the index: a Bumped or RBF-cancelled request none of whose replacements (recursively) confirmed goes back to OnChainConfirmationPending; rows whose replacement confirmed are already final. Then a guard raises a readable error if any request has more than one live replacement. Before deploying to prod run:

SELECT "BumpingWalletWithdrawalRequestId", count(*) FROM "WalletWithdrawalRequests"
WHERE "BumpingWalletWithdrawalRequestId" IS NOT NULL AND "Status" IN (0, 3, 4, 7)
GROUP BY 1 HAVING count(*) > 1;   -- expected: no rows

Tests

• Unit: 823 passing (Category!=E2E), just check-migrations clean. New coverage for the guard, the race on insert, the chain reconciliation (bump of a bump, bump of a cancellation, cancellation of a bump, cold replacement awaiting approval, finalizing rows skipped, both directions confirmed), the derived statuses over gRPC, the by-reference chain response, and the mapper.
• E2E: expectations updated (BumpOfABump… now expects B and C failed; the by-reference assertion expects the whole chain). Not run locally yet: add the run-e2e-tests label.

[markettes]

Folded into #642.