security: fix audit points 5-9 + optimize echo_push/info endpoints

- Point 5 (SSRF): Add URL validation for WELIST_SERVER_URL (src/validation.rs)
- Point 6 (DB Access): Add DB path validation, symlink check, WAL mode (open_db)
- Point 8 (HTTPS): Extract nginx config, add deployment checklist, bind warnings
- Point 9 (Input Validation): Add NETWORKS check (404 for unknown), txid 64-hex validation
- Optimize echo_push: parse transactions outside DB lock, batch duplicate check, N+1 xpub lookup eliminated via HashSet cache
- Optimize echo_info: derive BIP32 address outside DB lock, minimize lock duration
- Fix echo_stats SQL injection via parameter binding + add idx_stats_chain index
- New regression tests: ssrf_tests, db_path_validation, input_validation_tests

bal-server.env

@@ -1,6 +1,7 @@
 RUST_LOG=info
 BAL_SERVER_DB_FILE="/home/bal/bal.db"
 BAL_SERVER_INFO="BAL server test willexecutor"
+# !!! WARNING: Never bind to 0.0.0.0 in production. Use 127.0.0.1 and place Nginx with TLS in front.
 BAL_SERVER_BIND_ADDRESS=127.0.0.1
 BAL_SERVER_BIND_PORT=9133
 BAL_SERVER_BITCOIN_ADDRESS="your bitcoin or xpub to recive payments here"
@@ -13,3 +14,17 @@ BAL_SERVER_REGTEST_FEE=5000
 #BAL_SERVER_TESTNET_FEE=100000
 #BAL_SERVER_SIGNET_ADDRESS=
 #BAL_SERVER_SIGNET_FEE=100000
+
+# Actix Web DoS Protection Settings (added with migration to Actix Web)
+BAL_SERVER_ACTIX_MAX_BODY_SIZE=1048576
+BAL_SERVER_ACTIX_TIMEOUT_SECS=5
+BAL_SERVER_ACTIX_PUSHTXS_PER_SEC=1
+BAL_SERVER_ACTIX_PUSHTXS_BURST=3
+BAL_SERVER_ACTIX_SEARCHTX_PER_SEC=5
+BAL_SERVER_ACTIX_SEARCHTX_BURST=10
+BAL_SERVER_ACTIX_INFO_PER_SEC=20
+BAL_SERVER_ACTIX_INFO_BURST=30
+BAL_SERVER_ACTIX_DEFAULT_PER_SEC=50
+BAL_SERVER_ACTIX_DEFAULT_BURST=100
+BAL_SERVER_ACTIX_WORKERS=4
+BAL_SERVER_ACTIX_MAX_CONNECTIONS=100