security: fix unwrap/expect/panic on untrusted input (Fase 3 MEDIUM/LOW)

- xpub.rs: Replace convert_xpub() unwrap() with Result propagation
- xpub.rs: Replace calculate_fingerprint() unwrap() with Result propagation
- xpub.rs: Replace get_bitcoincore_descriptor() unwrap() with Result/match
- xpub.rs: Fix new_address_from_xpub() call in bal-server.rs to handle Result
- xpub.rs: Add prefix validation in convert_xpub (xpub/ypub/zpub/tpub/vpub/upub)
- bal-pusher.rs: Remove parse().unwrap() on env var bool, use unwrap_or(false)
- bal-pusher.rs: Replace port try_into().unwrap() with safe u16::try_from match
- bal-pusher.rs: Add error logging for invalid port values in env vars
- All tests pass: cargo test (5 tests: 3 SQL + 2 panic regression)
- Build verified: cargo check --bin=bal-server --bin=bal-pusher (0 errors)

src/bin/bal-pusher.rs

@@ -58,7 +58,7 @@ impl Default for MyConfig {
             send_stats: env::var("BAL_PUSHER_SEND_STATS")
                 .unwrap_or("false".to_string())
                 .parse::<bool>()
-                .unwrap(),
+                .unwrap_or(false),
             url: env::var("BAL_SERVER_URL").unwrap_or("http://localhost/".to_string()),
             ssl_key_path: env::var("SSL_KEY_PATH").unwrap_or("privkey.pem".to_string()),
         }
@@ -481,7 +481,12 @@ fn parse_env_netconfig(cfg_lock: &mut MyConfig, chain: &str) -> NetworkParams {
     match env::var(format!("BAL_PUSHER_{}_PORT", chain.to_uppercase())) {
         Ok(value) => match value.parse::<u64>() {
             Ok(value) => {
-                cfg.port = value.try_into().unwrap();
+                match u16::try_from(value) {
+                    Ok(port) => cfg.port = port,
+                    Err(e) => {
+                        error!("Port value {} exceeds u16 range for chain {}: {}", value, chain, e);
+                    }
+                }
             }
             Err(_) => {}
         },