security: fix audit points 5-9 + optimize echo_push/info endpoints

- Point 5 (SSRF): Add URL validation for WELIST_SERVER_URL (src/validation.rs)
- Point 6 (DB Access): Add DB path validation, symlink check, WAL mode (open_db)
- Point 8 (HTTPS): Extract nginx config, add deployment checklist, bind warnings
- Point 9 (Input Validation): Add NETWORKS check (404 for unknown), txid 64-hex validation
- Optimize echo_push: parse transactions outside DB lock, batch duplicate check, N+1 xpub lookup eliminated via HashSet cache
- Optimize echo_info: derive BIP32 address outside DB lock, minimize lock duration
- Fix echo_stats SQL injection via parameter binding + add idx_stats_chain index
- New regression tests: ssrf_tests, db_path_validation, input_validation_tests

tests/panic_regression_tests.rs

@@ -1,7 +1,7 @@
+use sqlite::Connection;
+use std::collections::HashMap;
 use std::sync::{Arc, Mutex};
 use std::thread;
-use std::collections::HashMap;
-use sqlite::Connection;
 
 #[test]
 fn test_mutex_poisoning_recovery() {
@@ -28,16 +28,22 @@ fn test_mutex_poisoning_recovery() {
 #[test]
 fn test_db_null_unwrap_or() {
     let db = Connection::open(":memory:").unwrap();
-    let _ = db.execute("CREATE TABLE test_stats (report_date TEXT, chain TEXT, totals TEXT, waiting TEXT);");
-    let _ = db.execute("INSERT INTO test_stats (report_date, chain) VALUES ('2024-01-01', 'testnet');");
-    
+    let _ = db.execute(
+        "CREATE TABLE test_stats (report_date TEXT, chain TEXT, totals TEXT, waiting TEXT);",
+    );
+    let _ =
+        db.execute("INSERT INTO test_stats (report_date, chain) VALUES ('2024-01-01', 'testnet');");
+
     let mut found_value = None;
     let _ = db.iterate("SELECT * FROM test_stats;", |pairs| {
-        let row: HashMap<_, _> = pairs.into_iter().map(|(k,v)| (k.to_string(), v.map(|s| s))).collect();
+        let row: HashMap<_, _> = pairs
+            .into_iter()
+            .map(|(k, v)| (k.to_string(), v.map(|s| s)))
+            .collect();
         let totals = row["totals"].clone().unwrap_or("0").to_string();
         found_value = Some(totals);
         true
     });
-    
+
     assert_eq!(found_value.unwrap(), "0");
 }