fix(sim): cap crash point so extreme seeds cannot overflow or bankrupt

At u=1 the unsigned quotient exceeded int64 and wrapped negative, so the
rarest and most valuable outcome silently became an instant 1.00x loss.
At u=2 it produced a 2.1-billion-times payout the house could never
cover, which would have left settlement failing and the player unpaid.
The crash point is now capped at the largest multiplier the curve can
express, which is unreachable anyway since the round hits its tick
ceiling first.

FromInt now panics outside the Q32.32 integer range instead of wrapping
a positive input into a negative value.

Raises coverage to 88% overall; adds a Makefile with db-reset, since the
append-only ledger steadily consumes bridge headroom across test runs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

pkg/sim/crash.go

@@ -44,10 +44,22 @@ func CrashPoint(seed [32]byte) fixed.F {
 
 	// crash = payoutRatio / (u / 2^32), computed as (payoutRatio * 2^32) / u
 	// through a 128-bit intermediate so no precision is lost.
-	// hi is zero because payoutRatio < 2^32, so the division cannot overflow.
 	hi, lo := bits.Mul64(payoutRatio, 1<<32)
 	q, _ := bits.Div64(hi, lo, u)
 
+	// The quotient can exceed int64 for the very smallest u — at u=1 it wraps
+	// negative, which would silently turn the rarest and most valuable outcome
+	// into an instant loss. Compare in unsigned space before converting.
+	//
+	// The cap is the largest multiplier the curve can express. Anything above
+	// it is unreachable anyway: the round would hit its tick ceiling first.
+	// It also bounds the maximum payout, so a single round cannot demand more
+	// than the house can hold.
+	maxCP := MaxMultiplier()
+	if q >= uint64(maxCP) {
+		return maxCP
+	}
+
 	cp := fixed.F(q)
 	if cp < fixed.One {
 		cp = fixed.One