fix: per-endpoint rate limits, request timeout and input hardening

bal-server:
- Wire independent actix-governor buckets per endpoint class (pushtxs,
  searchtx, info/stats, default) so polling a cheap endpoint can no longer
  exhaust the push-txs budget; previously every limit was dead config
- Enforce BAL_SERVER_ACTIX_TIMEOUT_SECS via a request-timeout middleware that
  returns 408 Request Timeout, covering slow request bodies
- De-duplicate txids within a single /pushtxs request body
- Replace the byte-slice xpub detection (panic on non-ASCII) with a safe
  prefix check

bal-pusher:
- Handle malformed/empty ZMQ frames without indexing panics or UTF-8 expect
- Return an error from sign_message and skip the stats report instead of
  panicking when the private key cannot be parsed

validation / db:
- Reject IPv4-mapped IPv6 targets (::ffff:a.b.c.d) in is_valid_welist_url
  to close an SSRF bypass, with unit tests
- Use Path::starts_with for the SQLite forbidden-directory check so paths
  like /etcfoo are not misclassified

misc:
- Add explicit secret patterns to .gitignore and sync the docs

src/db/mod.rs

@@ -38,13 +38,23 @@ fn validate_sqlite_path(dsn: &str) -> Result<(), String> {
     // If absolute, block known sensitive system directories
     if p.is_absolute() {
         let forbidden = [
-            "/etc", "/proc", "/sys", "/dev", "/usr", "/bin", "/sbin", "/lib", "/opt",
+            Path::new("/etc"),
+            Path::new("/proc"),
+            Path::new("/sys"),
+            Path::new("/dev"),
+            Path::new("/usr"),
+            Path::new("/bin"),
+            Path::new("/sbin"),
+            Path::new("/lib"),
+            Path::new("/opt"),
         ];
         for prefix in &forbidden {
-            if path_str.starts_with(prefix) {
+            // `Path::starts_with` matches whole path components, so "/etcfoo"
+            // is not treated as being under "/etc".
+            if p.starts_with(prefix) {
                 return Err(format!(
                     "Absolute database path under {} is forbidden",
-                    prefix
+                    prefix.display()
                 ));
             }
         }