docker: add release Dockerfile, fix build deps and feature-split builds

- Add Dockerfile.release: downloads latest release from Gitea, verifies SHA-256
- Fix Dockerfile: remove unused libsodium/cmake, add libsqlite3-dev
- Split build per binary with --no-default-features --features server/pusher
- Remove Cargo.lock from .dockerignore for reproducible builds
- Update README and knowledge base with Dockerfile.release docs

docs/01_project_overview.md

@@ -39,7 +39,12 @@ The project uses Cargo feature flags to build each binary independently:
 
 ## Docker Support
 
-The project includes a multi-stage `Dockerfile` using `rust:1.95-bookworm` as the builder and `debian:bookworm-slim` as the runtime. The container runs as a non-root `bal` user (uid 1000) with `tini` as PID 1 and includes a healthcheck endpoint.
+Two Dockerfiles are provided:
+
+- **`Dockerfile.release`** (recommended for production): Downloads the latest pre-built release from the Gitea server. No Rust toolchain needed. Verifies SHA-256 checksum. Supports pinning a specific version via `BAL_VERSION` build arg.
+- **`Dockerfile`** (for development/custom builds): Multi-stage build using `rust:1.95-bookworm` as the builder and `debian:bookworm-slim` as the runtime. Each binary is compiled with only its required features (`--no-default-features --features server` / `--features pusher`).
+
+Both run as a non-root `bal` user (uid 1000) with `tini` as PID 1 and include a healthcheck endpoint.
 
 ## Mapping to Existing Documentation
 

docs/07_deployment_and_ops.md

@@ -93,17 +93,38 @@ Default ports per network:
 
 ## Docker
 
-The project includes a multi-stage `Dockerfile`:
+The project provides two Dockerfiles:
 
-- **Builder stage:** `rust:1.95-bookworm` with full build.
+### `Dockerfile.release` — Download pre-built release (recommended for production)
+
+Downloads the latest release from the Gitea server. No Rust toolchain needed. Fast builds.
+
+```bash
+# Latest release
+docker build -f Dockerfile.release -t bal-server .
+
+# Specific version
+docker build -f Dockerfile.release --build-arg BAL_VERSION=v0.3.2 -t bal-server:0.3.2 .
+```
+
+- Fetches `.tar.gz` from `https://bitcoin-after.life/gitea/api/v1/repos/bitcoinafterlife/bal-server/releases/latest`.
+- Verifies SHA-256 checksum if available.
+- Single-stage image (`debian:bookworm-slim`), minimal size.
+- `BAL_VERSION` build arg: set to a tag (e.g., `v0.3.2`) to pin a specific release.
+
+### `Dockerfile` — Build from source
+
+Multi-stage build with the Rust toolchain. Use for development or custom builds.
+
+- **Builder stage:** `rust:1.95-bookworm` with full build. Each binary is compiled with only its required features (`--no-default-features --features server` / `--features pusher`).
 - **Runtime stage:** `debian:bookworm-slim` with minimal runtime.
 - **User:** Non-root `bal` user (uid 1000).
 - **PID 1:** `tini` for proper signal handling.
 - **Healthcheck:** `curl -f http://localhost:9137/ || exit 1`.
 
-Build and run:
+### Run (both Dockerfiles)
+
 ```bash
-docker build -t bal-server .
 docker run -d \
   --name bal-server \
   -v /var/bal:/var/bal \

docs/09_references_and_links.md

@@ -29,7 +29,8 @@
 | Contrib (install bitcoind) | `contrib/download_and_install_bitcoincore.sh` | Bitcoind download, GPG verify, systemd, config |
 | Contrib (install Tor) | `contrib/install_tor.sh` | Tor repository, `ControlPort 9051` |
 | Nginx template | `contrib/nginx/bal-server.conf` | TLS termination, security headers, rate limiting |
-| Dockerfile | `Dockerfile` | Multi-stage build, non-root user, tini, healthcheck |
+| Dockerfile | `Dockerfile` | Multi-stage build from source, non-root user, tini, healthcheck |
+| Dockerfile.release | `Dockerfile.release` | Download latest release from Gitea, SHA-256 verification |
 
 | Systemd Service | File | Purpose |
 |---|---|---|