security: fix unwrap/expect/panic on untrusted input (Fase 3 MEDIUM/LOW)

- xpub.rs: Replace convert_xpub() unwrap() with Result propagation
- xpub.rs: Replace calculate_fingerprint() unwrap() with Result propagation
- xpub.rs: Replace get_bitcoincore_descriptor() unwrap() with Result/match
- xpub.rs: Fix new_address_from_xpub() call in bal-server.rs to handle Result
- xpub.rs: Add prefix validation in convert_xpub (xpub/ypub/zpub/tpub/vpub/upub)
- bal-pusher.rs: Remove parse().unwrap() on env var bool, use unwrap_or(false)
- bal-pusher.rs: Replace port try_into().unwrap() with safe u16::try_from match
- bal-pusher.rs: Add error logging for invalid port values in env vars
- All tests pass: cargo test (5 tests: 3 SQL + 2 panic regression)
- Build verified: cargo check --bin=bal-server --bin=bal-pusher (0 errors)

src/bin/bal-pusher.rs

@@ -58,7 +58,7 @@ impl Default for MyConfig {
             send_stats: env::var("BAL_PUSHER_SEND_STATS")
                 .unwrap_or("false".to_string())
                 .parse::<bool>()
-                .unwrap(),
+                .unwrap_or(false),
             url: env::var("BAL_SERVER_URL").unwrap_or("http://localhost/".to_string()),
             ssl_key_path: env::var("SSL_KEY_PATH").unwrap_or("privkey.pem".to_string()),
         }
@@ -481,7 +481,12 @@ fn parse_env_netconfig(cfg_lock: &mut MyConfig, chain: &str) -> NetworkParams {
     match env::var(format!("BAL_PUSHER_{}_PORT", chain.to_uppercase())) {
         Ok(value) => match value.parse::<u64>() {
             Ok(value) => {
-                cfg.port = value.try_into().unwrap();
+                match u16::try_from(value) {
+                    Ok(port) => cfg.port = port,
+                    Err(e) => {
+                        error!("Port value {} exceeds u16 range for chain {}: {}", value, chain, e);
+                    }
+                }
             }
             Err(_) => {}
         },

src/bin/bal-server.rs

@@ -259,13 +259,21 @@ async fn echo_info(
                 Some(address) => address,
                 None => {
                     let next = get_next_address_index(&db, &netconfig.name, &netconfig.address);
-                    let address =
-                        new_address_from_xpub(&netconfig.address, next.1, netconfig.network)
-                            .unwrap();
+                    match new_address_from_xpub(&netconfig.address, next.1, netconfig.network) {
+                    Ok(address) => {
                     save_new_address(&db, next.0, &address.0, &address.1, &remote_addr);
                     debug!("save new address {} {}", address.0, address.1);
                     trace!("next {} {}", next.0, next.1);
                     address.0
+                    }
+                    Err(e) => {
+                    error!("Failed to derive address from xpub: {}", e);
+                    // Return error response to the client
+                    let mut response = Response::new(full(format!("Failed to derive address: {}", e)));
+                    *response.status_mut() = StatusCode::BAD_REQUEST;
+                    return Ok(response);
+                    }
+                    }
                 }
             }
         }