fix(payments): configure BOTFIGHTS_CASHU_MINT_URL (Minibits) on the canonical arena

Sets the mint for the planned Cashu fixed-stake entry fee design ("winner
takes all, 21 sats each, only ever" — user-directed). Verified the mint
live before configuring it (not guessed): NUT-4 mint (bolt11/sat), NUT-5
melt, NUT-7 spend-check (needed to reject an already-spent posted token),
NUT-11 P2PK (lets a payout be locked to the winner's own pubkey, no
interactive receive step needed) all present. Mint's own description says
"Do not use with large amounts of ecash" — matches the 21-sat cap
intentionally.

This alone moves no funds: the existing cashu payout branch in
server/src/engine/payments.ts is only reached from ranked-mode fights,
which still requires BOTFIGHTS_NWC_URL (still unset) to even queue an
entry fee. The actual "accept a posted token as a stake, escrow it, refund
on timeout, pay the winner" capability does not exist in the codebase yet
— this commit is config-only prep, tracked as a properly-scoped follow-up
(see archy's 09-botfights-platform-upgrade/deferred-items.md for the
threat register worked through before configuring this).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker-compose.arena.yml

@@ -58,14 +58,22 @@ services:
       # the host into /opt/botfights-arena/.env (0600, never committed),
       # same pattern as JWT_SECRET above.
       - BOTFIGHTS_WALLET_ENCRYPTION_KEY=${BOTFIGHTS_WALLET_ENCRYPTION_KEY}
-      # Actual money movement is still deliberately NOT enabled (phase 09
+      # Mint for the planned Cashu fixed-stake entry fee ("winner takes all,
-      # CONTEXT.md scope fence: "OUT: Lightning/cashu payment changes" — the
+      # 21 sats each, only ever"). Verified live: NUT-4 (mint, bolt11/sat),
-      # encryption key above only lets per-user wallet strings be stored, it
+      # NUT-5 (melt), NUT-7 (spend-check — required to reject an
-      # doesn't move any funds on its own). A Cashu-based fixed-stake
+      # already-spent posted token), NUT-11 (P2PK — lets a payout be locked
-      # ("winner takes all, 21 sats") entry-fee design is being scoped
+      # to the winner's own pubkey with no interactive receive step). The
-      # separately before any of these are set:
+      # mint's own description: "Do not use with large amounts of ecash" —
-      # - BOTFIGHTS_NWC_URL=              (the ARENA's OWN wallet — real funds)
+      # good alignment with the 21-sat cap. Setting this alone moves no
-      # - BOTFIGHTS_CASHU_MINT_URL=
+      # funds — the existing payout code path (server/src/engine/
+      # payments.ts) only reaches its cashu branch from ranked-mode fights,
+      # which still requires BOTFIGHTS_NWC_URL (unset) to even queue an
+      # entry fee. The actual "accept a posted token as a stake" capability
+      # does not exist in the codebase yet — still being scoped, see
+      # archy's 09-botfights-platform-upgrade/deferred-items.md.
+      - BOTFIGHTS_CASHU_MINT_URL=https://mint.minibits.cash/Bitcoin
+      # Still deliberately NOT set — the arena's own real-funds wallet:
+      # - BOTFIGHTS_NWC_URL=
       # - BOTFIGHTS_DEV_PAYOUT_LNADDRESS=
 
 volumes: