chore: unify DB env vars and harden local Postgres startup

- Use BAL_SERVER_DB_* / BAL_SERVER_PG_DSN in bal-pusher, Dockerfiles,
  scripts and docs instead of the BAL_PUSHER_DB_* duplicates
- Default BAL_SERVER_URL to http://127.0.0.1:9133
- Extract PostgreSQL container startup into a shared pg-server.sh sourced by
  bal-server.sh and bal-pusher.sh
- Read the Postgres password from BAL_PG_PASSWORD instead of hardcoding it,
  and stop printing the password-bearing DSN
- Redact a real-looking Gitea token from .env.example (revoke it if it was live)

.env.example

@@ -3,8 +3,7 @@
 # DO NOT commit the real token to git!
 # This file is in .gitignore and should not be committed to git
 GITEA_API_TOKEN=your_gitea_api_token_here
-# Example: GITEA_API_TOKEN=***REMOVED***
-# (replace with your actual token after revoking the old one)
+# If a token was ever committed, revoke it and set a new one via the environment.
 
 # === bal-server ===
 # !!! WARNING: Never bind to 0.0.0.0 in production. Use 127.0.0.1 and place
@@ -33,8 +32,14 @@ BAL_SERVER_ACTIX_DEFAULT_BURST=100
 BAL_SERVER_ACTIX_WORKERS=4
 BAL_SERVER_ACTIX_MAX_CONNECTIONS=100
 
+# === PostgreSQL (optional; used by pg-server.sh) ===
+# pg-server.sh requires BAL_PG_PASSWORD to be set; never commit a real password.
+BAL_PG_PASSWORD=change_me
+BAL_PG_USER=bal
+BAL_PG_DB=baldb
+
 # === bal-pusher ===
-BAL_PUSHER_DB_FILE=/var/bal/bal.db
+BAL_SERVER_DB_FILE=/var/bal/bal.db
 BAL_PUSHER_BITCOIN_DIR=/home/bal/.bitcoin
 BAL_PUSHER_SEND_STATS=false
 BAL_SERVER_URL=http://127.0.0.1:9137