chore: unify DB env vars and harden local Postgres startup

- Use BAL_SERVER_DB_* / BAL_SERVER_PG_DSN in bal-pusher, Dockerfiles,
  scripts and docs instead of the BAL_PUSHER_DB_* duplicates
- Default BAL_SERVER_URL to http://127.0.0.1:9133
- Extract PostgreSQL container startup into a shared pg-server.sh sourced by
  bal-server.sh and bal-pusher.sh
- Read the Postgres password from BAL_PG_PASSWORD instead of hardcoding it,
  and stop printing the password-bearing DSN
- Redact a real-looking Gitea token from .env.example (revoke it if it was live)

bal-server.sh

@@ -31,31 +31,7 @@ export BAL_SERVER_REGTEST_FIXED_FEE=1000
 export BAL_SERVER_DB_BACKEND="postgresql"
 
 if [ "$BAL_SERVER_DB_BACKEND" = "postgresql" ]; then
-    PG_CONTAINER="bal-pg"
-    PG_DSN="${BAL_SERVER_PG_DSN:-postgres://bal:***REMOVED***@localhost:5432/baldb}"
-
-    docker rm -f "$PG_CONTAINER" 2>/dev/null || true
-    echo_i "Starting PostgreSQL container..."
-    docker run -d --name "$PG_CONTAINER" \
-        -e POSTGRES_USER=bal \
-        -e POSTGRES_PASSWORD=***REMOVED*** \
-        -e POSTGRES_DB=baldb \
-        -p 5432:5432 postgres:16-alpine
-
-    echo_i "Waiting for PostgreSQL..."
-    until docker exec "$PG_CONTAINER" pg_isready -U bal >/dev/null 2>&1; do
-        sleep 1
-    done
-    echo_i "PostgreSQL ready at $PG_DSN"
-    export BAL_SERVER_PG_DSN="$PG_DSN"
-
-
-    cleanup() {
-        echo_i "Stopping PostgreSQL container..."
-        docker stop "$PG_CONTAINER" >/dev/null 2>&1
-        docker rm "$PG_CONTAINER" >/dev/null 2>&1
-    }
-    trap cleanup EXIT
+    . "$SCRIPT_DIR/pg-server.sh"
 fi
 
 cargo run --bin=bal-server