security: fix audit points 5-9 + optimize echo_push/info endpoints

- Point 5 (SSRF): Add URL validation for WELIST_SERVER_URL (src/validation.rs)
- Point 6 (DB Access): Add DB path validation, symlink check, WAL mode (open_db)
- Point 8 (HTTPS): Extract nginx config, add deployment checklist, bind warnings
- Point 9 (Input Validation): Add NETWORKS check (404 for unknown), txid 64-hex validation
- Optimize echo_push: parse transactions outside DB lock, batch duplicate check, N+1 xpub lookup eliminated via HashSet cache
- Optimize echo_info: derive BIP32 address outside DB lock, minimize lock duration
- Fix echo_stats SQL injection via parameter binding + add idx_stats_chain index
- New regression tests: ssrf_tests, db_path_validation, input_validation_tests

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "bal_server"
-version = "0.2.3"
+version = "0.3.0"
 edition = "2024"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
@@ -17,9 +17,8 @@ chrono = 		{ version = "0.4.40" }
 env_logger = 		{ version = "0.11.5" }
 hex = 			{ version = "0.4.3" }
 hex-conservative = 	{ version = "0.1.1" }
-hyper = 		{ version = "1.3.1", features = ["http1","server"] }
-hyper-util = 		{ version = "0.1.3", features = ["tokio"] }
-http-body-util = 	{ version = "0.1" }
+actix-web = 		{ version = "4.9.0" }
+actix-governor = 	{ version = "0.6.0" }
 log = 			{ version = "0.4.21" }
 openssl = 		{ version = "0.10.74", features = ["vendored"] }
 sha2 = 			{ version = "0.10.8" }
@@ -28,6 +27,16 @@ serde_json = 		{ version = "1.0.116" }
 sqlite = 		{ version = "0.34.0" }
 regex = 		{ version = "1.10.4" }
 reqwest = 		{ version = "0.12.24", features = ["json","socks"] }
-tokio = 		{ version = "1", features = ["rt", "net","macros","rt-multi-thread"] }  # Keep only necessary runtime components
+actix-rt = 		{ version = "2.10.0" }
+tokio = 		{ version = "1", features = ["rt", "net","macros","rt-multi-thread"] }
+url = 			{ version = "2" }
 zmq = 			{ version = "0.10.0" }
 
+[[bin]]
+name = "bal-server"
+path = "src/bin/bal-server-actix.rs"
+
+[[bin]]
+name = "bal-pusher"
+path = "src/bin/bal-pusher.rs"
+