fix: Docker support, WAL race condition, pusher panic fixes

- Add multi-stage Dockerfile with tini, non-root user, healthcheck
- Fix SQLite WAL mode race between bal-server and bal-pusher (busy_timeout + retry)
- Fix tbl_stats missing UNIQUE index for ON CONFLICT clause
- Replace unwrap() panics in bal-pusher with graceful error handling
- Add docker/entrypoint.sh with BAL_PUSHER_NETWORK support
- cargo fmt across all files

Dockerfile

@@ -0,0 +1,92 @@
+# =============================================================================
+# Multi-stage Dockerfile for bal-server + bal-pusher
+# Security: non-root user, minimal runtime, tini as PID 1
+# =============================================================================
+
+# ---------------------------------------------------------------------------
+# Stage 1: Builder
+# ---------------------------------------------------------------------------
+FROM rust:1.95-bookworm AS builder
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    pkg-config \
+    libssl-dev \
+    libsodium-dev \
+    libzmq5-dev \
+    cmake \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /build
+
+# Cache dependencies: copy Cargo.toml first, create dummy src to build deps
+COPY Cargo.toml Cargo.lock* ./
+RUN mkdir -p src/bin && \
+    echo 'fn main() {}' > src/bin/bal-server-actix.rs && \
+    echo 'fn main() {}' > src/bin/bal-pusher.rs && \
+    echo '' > src/lib.rs && \
+    echo '' > src/db.rs && \
+    echo '' > src/xpub.rs && \
+    echo '' > src/validation.rs && \
+    cargo build --release --bin bal-server --bin bal-pusher 2>/dev/null || true && \
+    rm -rf src target/release/.fingerprint target/release/deps/*bal_server*
+
+# Copy real source and build
+COPY src/ src/
+RUN cargo build --release --bin bal-server --bin bal-pusher && \
+    strip target/release/bal-server target/release/bal-pusher
+
+# ---------------------------------------------------------------------------
+# Stage 2: Runtime
+# ---------------------------------------------------------------------------
+FROM debian:bookworm-slim AS runtime
+
+# Install runtime dependencies + tini for PID 1
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libssl3 \
+    libsodium23 \
+    libzmq5 \
+    libsqlite3-0 \
+    ca-certificates \
+    curl \
+    tini \
+    && rm -rf /var/lib/apt/lists/* \
+    && apt-get clean
+
+# Copy binaries from builder
+COPY --from=builder /build/target/release/bal-server /usr/local/bin/bal-server
+COPY --from=builder /build/target/release/bal-pusher /usr/local/bin/bal-pusher
+
+# Create dedicated non-root user
+RUN groupadd -g 1000 bal && \
+    useradd -u 1000 -g bal -s /usr/sbin/nologin -M bal && \
+    mkdir -p /var/bal /var/bal/.bitcoin && \
+    chown -R bal:bal /var/bal && \
+    chmod 700 /var/bal
+
+# Copy entrypoint
+COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+
+# Use tini as PID 1 for proper signal handling
+ENTRYPOINT ["/usr/bin/tini", "--"]
+CMD ["/usr/local/bin/entrypoint.sh"]
+
+# Data directory (mount as volume)
+VOLUME ["/var/bal"]
+
+# bal-server port (bind to 127.0.0.1 via env, expose for reverse proxy)
+EXPOSE 9137
+
+# Default environment (override at runtime)
+ENV RUST_LOG=info \
+    BAL_SERVER_BIND_ADDRESS=127.0.0.1 \
+    BAL_SERVER_BIND_PORT=9137 \
+    BAL_SERVER_DB_FILE=/var/bal/bal.db \
+    BAL_PUSHER_DB_FILE=/var/bal/bal.db \
+    BAL_SERVER_URL=http://127.0.0.1:9137 \
+    BAL_SERVER_PUB_KEY_PATH=/var/bal/public_key.pem \
+    SSL_KEY_PATH=/var/bal/private_key.pem
+
+# Health check: verify bal-server is responding
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD curl -sf http://127.0.0.1:9137/ || exit 1