docker: add release Dockerfile, fix build deps and feature-split builds

- Add Dockerfile.release: downloads latest release from Gitea, verifies SHA-256
- Fix Dockerfile: remove unused libsodium/cmake, add libsqlite3-dev
- Split build per binary with --no-default-features --features server/pusher
- Remove Cargo.lock from .dockerignore for reproducible builds
- Update README and knowledge base with Dockerfile.release docs

docs/07_deployment_and_ops.md

@@ -93,17 +93,38 @@ Default ports per network:
 
 ## Docker
 
-The project includes a multi-stage `Dockerfile`:
+The project provides two Dockerfiles:
 
-- **Builder stage:** `rust:1.95-bookworm` with full build.
+### `Dockerfile.release` — Download pre-built release (recommended for production)
+
+Downloads the latest release from the Gitea server. No Rust toolchain needed. Fast builds.
+
+```bash
+# Latest release
+docker build -f Dockerfile.release -t bal-server .
+
+# Specific version
+docker build -f Dockerfile.release --build-arg BAL_VERSION=v0.3.2 -t bal-server:0.3.2 .
+```
+
+- Fetches `.tar.gz` from `https://bitcoin-after.life/gitea/api/v1/repos/bitcoinafterlife/bal-server/releases/latest`.
+- Verifies SHA-256 checksum if available.
+- Single-stage image (`debian:bookworm-slim`), minimal size.
+- `BAL_VERSION` build arg: set to a tag (e.g., `v0.3.2`) to pin a specific release.
+
+### `Dockerfile` — Build from source
+
+Multi-stage build with the Rust toolchain. Use for development or custom builds.
+
+- **Builder stage:** `rust:1.95-bookworm` with full build. Each binary is compiled with only its required features (`--no-default-features --features server` / `--features pusher`).
 - **Runtime stage:** `debian:bookworm-slim` with minimal runtime.
 - **User:** Non-root `bal` user (uid 1000).
 - **PID 1:** `tini` for proper signal handling.
 - **Healthcheck:** `curl -f http://localhost:9137/ || exit 1`.
 
-Build and run:
+### Run (both Dockerfiles)
+
 ```bash
-docker build -t bal-server .
 docker run -d \
   --name bal-server \
   -v /var/bal:/var/bal \