feat(pusher): add opt-in v2 WeTime ping signing

- Add WELIST_PING_SIG_VERSION (1 legacy, 2 canonical JSON); default 1
- Sign WELIST-PING-V2\n + compact sorted JSON covering url, chain, height,
  median_time, last_block_hash, info, base_fee, version and sig_version
- Fetch info/base_fee/version from the local /{chain}/info endpoint and sign them
- Fall back to null metadata on fetch failure; skip the fetch for onion URLs
- Normalize the advertised URL and bound metadata to match the WeTime service
- Activate v2 in bal-pusher.sh and document the TXT record setup
- Add unit tests for canonical payloads, URL normalization, metadata and onion detection

Includes previously uncommitted local deployment hardening:
- pg-server.sh configurable loopback bind address, volume and recreate handling
- .env loading in bal-server.sh and bal-pusher.sh
- second bal-server/bal-pusher development scripts

.env.example

@@ -37,6 +37,12 @@ BAL_SERVER_ACTIX_MAX_CONNECTIONS=100
 BAL_PG_PASSWORD=change_me
 BAL_PG_USER=bal
 BAL_PG_DB=baldb
+# Docker volume that stores the database, so the container can be recreated
+# without losing data.
+BAL_PG_VOLUME=bal-pg-data
+# Interface on which the container publishes port 5432. Keep 127.0.0.1 so the
+# database listens on loopback only; 0.0.0.0 would expose it on every interface.
+BAL_PG_BIND_ADDR=127.0.0.1
 
 # === bal-pusher ===
 BAL_SERVER_DB_FILE=/var/bal/bal.db
@@ -45,6 +51,10 @@ BAL_PUSHER_SEND_STATS=false
 BAL_SERVER_URL=http://127.0.0.1:9137
 SSL_KEY_PATH=/var/bal/private_key.pem
 WELIST_SERVER_URL=https://welist.bitcoin-after.life
+# Sign WeTime pings with the v2 canonical JSON scheme. Requires a DNSSEC-
+# validated `_welist-key.<host>` TXT record (or a v3 onion address). Omit or
+# set to 1 for the legacy scheme.
+WELIST_PING_SIG_VERSION=2
 
 # ZMQ endpoints per network (default: localhost only)
 BAL_PUSHER_BITCOIN_ZMQ_HASHBLOCK=tcp://127.0.0.1:28332