fix: Docker support, WAL race condition, pusher panic fixes

- Add multi-stage Dockerfile with tini, non-root user, healthcheck
- Fix SQLite WAL mode race between bal-server and bal-pusher (busy_timeout + retry)
- Fix tbl_stats missing UNIQUE index for ON CONFLICT clause
- Replace unwrap() panics in bal-pusher with graceful error handling
- Add docker/entrypoint.sh with BAL_PUSHER_NETWORK support
- cargo fmt across all files

tests/input_validation_tests.rs

@@ -10,15 +10,21 @@ fn setup_db_with_xpub() -> sqlite::Connection {
         "CREATE TABLE tbl_address (address TEXT PRIMARY KEY, path TEXT, xpub INTEGER, remote_address TEXT);"
     );
     // Insert test xpub
-    let mut stmt = db.prepare("INSERT INTO tbl_xpub(id, network, xpub) VALUES(?, ?, ?);").unwrap();
+    let mut stmt = db
+        .prepare("INSERT INTO tbl_xpub(id, network, xpub) VALUES(?, ?, ?);")
+        .unwrap();
     stmt.bind((1, Value::Integer(1))).unwrap();
-    stmt.bind((2, Value::String("testnet".to_string()))).unwrap();
-    stmt.bind((3, Value::String("tpub_test".to_string()))).unwrap();
+    stmt.bind((2, Value::String("testnet".to_string())))
+        .unwrap();
+    stmt.bind((3, Value::String("tpub_test".to_string())))
+        .unwrap();
     let _ = stmt.next();
     drop(stmt);
     // Insert test addresses
     for addr in ["addr1", "addr2", "addr3"] {
-        let mut stmt = db.prepare("INSERT INTO tbl_address(address, path, xpub) VALUES(?, ?, ?);").unwrap();
+        let mut stmt = db
+            .prepare("INSERT INTO tbl_address(address, path, xpub) VALUES(?, ?, ?);")
+            .unwrap();
         stmt.bind((1, Value::String(addr.to_string()))).unwrap();
         stmt.bind((2, Value::String("m/0/1".to_string()))).unwrap();
         stmt.bind((3, Value::Integer(1))).unwrap();
@@ -53,7 +59,10 @@ fn test_network_unknown_returns_404() {
     for n in networks {
         assert!(networks.contains(&n), "{} should be a valid network", n);
     }
-    assert!(!networks.contains(&"attacker"), "attacker should not be a valid network");
+    assert!(
+        !networks.contains(&"attacker"),
+        "attacker should not be a valid network"
+    );
 }
 
 #[test]