Fix #57: Ensure withdraw_fees provenance — per-market ledger, empty-side principal protection

[funds0033-cmyk]

Closes #57

Problem

withdraw_fees needed a hard guarantee that only genuine platform fees can ever be withdrawn — never another market's fees, and never user principal from an empty-side resolution.

What landed

1. Per-market fee ledger — place_bet credits MarketFees(market_id). AccumulatedFees is now only a cached sum of those entries plus pre-upgrade LegacyFees. cancel_market debits only that market's ledger, so cancelling one market can't wipe another market's fees.
2. Empty-side principal stays out of the pot — resolving an empty winning side writes Payout(net) for each bettor. withdraw_fees can only take the 2% platform fee, never user stake — bettors claim their net stake back separately.
3. Recipient + delay controls (already on main via [HIGH] withdraw_fees lets a fee recipient drain the entire accumulator to an arbitrary address with no cap or provenance check #12) preserved — fee recipients still can't be an arbitrary address, and withdrawals still go through the 20% cap + 24h request_withdraw_fees → execute_withdraw_fees path. Admin withdraw_fees keeps its existing 2-arg ABI so the rest of the suite still compiles.

New public API

• get_market_fees(market_id)
• get_legacy_fees()
• migrate_fee_ledger(admin) — for the upgrade path

Tests

Regressions added for: full-drain of principal, cross-market cancel, and arbitrary recipient.

Branch: fix/issue-57-withdraw-fees-provenance