chore: unify DB env vars and harden local Postgres startup

- Use BAL_SERVER_DB_* / BAL_SERVER_PG_DSN in bal-pusher, Dockerfiles,
  scripts and docs instead of the BAL_PUSHER_DB_* duplicates
- Default BAL_SERVER_URL to http://127.0.0.1:9133
- Extract PostgreSQL container startup into a shared pg-server.sh sourced by
  bal-server.sh and bal-pusher.sh
- Read the Postgres password from BAL_PG_PASSWORD instead of hardcoding it,
  and stop printing the password-bearing DSN
- Redact a real-looking Gitea token from .env.example (revoke it if it was live)

Dockerfile.release

@@ -90,7 +90,6 @@ ENV RUST_LOG=info \
     BAL_SERVER_BIND_ADDRESS=127.0.0.1 \
     BAL_SERVER_BIND_PORT=9137 \
     BAL_SERVER_DB_FILE=/var/bal/bal.db \
-    BAL_PUSHER_DB_FILE=/var/bal/bal.db \
     BAL_SERVER_URL=http://127.0.0.1:9137 \
     BAL_SERVER_PUB_KEY_PATH=/var/bal/public_key.pem \
     SSL_KEY_PATH=/var/bal/private_key.pem