security: fix unwrap/expect/panic on untrusted input (Fase 3 MEDIUM/LOW)

- xpub.rs: Replace convert_xpub() unwrap() with Result propagation
- xpub.rs: Replace calculate_fingerprint() unwrap() with Result propagation
- xpub.rs: Replace get_bitcoincore_descriptor() unwrap() with Result/match
- xpub.rs: Fix new_address_from_xpub() call in bal-server.rs to handle Result
- xpub.rs: Add prefix validation in convert_xpub (xpub/ypub/zpub/tpub/vpub/upub)
- bal-pusher.rs: Remove parse().unwrap() on env var bool, use unwrap_or(false)
- bal-pusher.rs: Replace port try_into().unwrap() with safe u16::try_from match
- bal-pusher.rs: Add error logging for invalid port values in env vars
- All tests pass: cargo test (5 tests: 3 SQL + 2 panic regression)
- Build verified: cargo check --bin=bal-server --bin=bal-pusher (0 errors)

src/bin/bal-server.rs

@@ -259,13 +259,21 @@ async fn echo_info(
                 Some(address) => address,
                 None => {
                     let next = get_next_address_index(&db, &netconfig.name, &netconfig.address);
-                    let address =
-                        new_address_from_xpub(&netconfig.address, next.1, netconfig.network)
-                            .unwrap();
+                    match new_address_from_xpub(&netconfig.address, next.1, netconfig.network) {
+                    Ok(address) => {
                     save_new_address(&db, next.0, &address.0, &address.1, &remote_addr);
                     debug!("save new address {} {}", address.0, address.1);
                     trace!("next {} {}", next.0, next.1);
                     address.0
+                    }
+                    Err(e) => {
+                    error!("Failed to derive address from xpub: {}", e);
+                    // Return error response to the client
+                    let mut response = Response::new(full(format!("Failed to derive address: {}", e)));
+                    *response.status_mut() = StatusCode::BAD_REQUEST;
+                    return Ok(response);
+                    }
+                    }
                 }
             }
         }