refactor: rename bal-server-actix.rs to bal-server.rs

- Rename src/bin/bal-server-actix.rs -> src/bin/bal-server.rs
- Update Cargo.toml to point to new filename
- Update Dockerfile reference
- Update docs/08_security_audit.md references

Cargo.toml

@@ -34,7 +34,7 @@ zmq = 			{ version = "0.10.0" }
 
 [[bin]]
 name = "bal-server"
-path = "src/bin/bal-server-actix.rs"
+path = "src/bin/bal-server.rs"
 
 [[bin]]
 name = "bal-pusher"

Dockerfile

@@ -21,7 +21,7 @@ WORKDIR /build
 # Cache dependencies: copy Cargo.toml first, create dummy src to build deps
 COPY Cargo.toml Cargo.lock* ./
 RUN mkdir -p src/bin && \
-    echo 'fn main() {}' > src/bin/bal-server-actix.rs && \
+    echo 'fn main() {}' > src/bin/bal-server.rs && \
     echo 'fn main() {}' > src/bin/bal-pusher.rs && \
     echo '' > src/lib.rs && \
     echo '' > src/db.rs && \

docs/08_security_audit.md

@@ -87,7 +87,7 @@ Regression tests: `tests/panic_regression_tests.rs` (2 tests).
 - Rate limiting: `actix-governor` middleware with token-bucket — configurable via `BAL_SERVER_ACTIX_PUSHTXS_PER_SEC`/`BURST` (default 1 req/s per IP with burst 5)
 - Connection limits: `workers(4)` and `max_connections(100)` — configurable via `BAL_SERVER_ACTIX_WORKERS`/`MAX_CONNECTIONS`
 - Body timeout: configurable via `BAL_SERVER_ACTIX_TIMEOUT_SECS` (default 30s)
-**Migration:** Server replaced `hyper` custom server with `actix-web` (see `src/bin/bal-server-actix.rs`). All handlers migrated with `Arc<Mutex<Connection>>` shared DB. Old `bal-server.rs` (Hyper) removed. `bal-pusher` enhanced with ZMQ timeout (`ZMQ_RCVTIMEO` 5000ms) and RPC retry logic. **Priority:** High. (Mitigated)
+**Migration:** Server replaced `hyper` custom server with `actix-web` (see `src/bin/bal-server.rs`). All handlers migrated with `Arc<Mutex<Connection>>` shared DB. Old `bal-server.rs` (Hyper) removed. `bal-pusher` enhanced with ZMQ timeout (`ZMQ_RCVTIMEO` 5000ms) and RPC retry logic. **Priority:** High. (Mitigated)
 
 ### 5. SSRF / Network Abuse via `reqwest` (MEDIUM)
 **Location:** `src/bin/bal-pusher.rs`.
@@ -121,7 +121,7 @@ Regression tests: `tests/panic_regression_tests.rs` (2 tests).
   - Rejects symlinks and non-regular files (directories, devices, etc.).
   - If validation fails, the function returns `Err(String)` instead of panicking, preventing crashes or accidental access to system files.
 - ✅ **WAL mode:** `db::open_db` automatically executes `PRAGMA journal_mode = WAL;` and `PRAGMA synchronous = NORMAL;` on every connection. This is a best practice for safe concurrent access when `bal-server` and `bal-pusher` share the same database file.
-- ✅ **Replaced `unwrap`:** In `src/bin/bal-server-actix.rs` and `src/bin/bal-pusher.rs`, `sqlite::open(...).unwrap()` was replaced with `db::open_db(...)` with safe error handling (return `Err` in the server, `std::process::exit(1)` in the pusher with a log error).
+- ✅ **Replaced `unwrap`:** In `src/bin/bal-server.rs` and `src/bin/bal-pusher.rs`, `sqlite::open(...).unwrap()` was replaced with `db::open_db(...)` with safe error handling (return `Err` in the server, `std::process::exit(1)` in the pusher with a log error).
 - **Remaining (ops):** Ensure the database file is owned by the `bal` user and not writable by any other user (`chmod 600`). The database file should not reside on a shared or network drive.
 **Regression tests:** `tests/db_path_validation.rs` (5 tests covering traversal, forbidden absolute paths, symlink, WAL pragma, and valid relative paths). All passing.
 **Status:** Fixed. **Priority:** Medium.