fix(#440 #441 #442 #443): harden Docker, gate dev settings, expand unit tests

[edwardfavour998-code]

#443 docker-compose.yml

• Gate resource limits behind COMPOSE_CPU_LIMIT / COMPOSE_MEMORY_LIMIT / COMPOSE_MEMORY_RESERVATION env vars so prod overrides require no file edits
• Add comment block explaining dev defaults and prod sizing guidance

#442 Dockerfile

• Add comment block with instructions to pin rust:1.88-bookworm and debian:bookworm-slim base images to sha256 digests for production builds
• Add OCI image description LABEL (non-root uid 1001)
• Confirm --no-install-recommends present on apt-get step

#441 src/ssrf.rs

• Add 10 targeted unit tests covering: broadcast, documentation ranges, multicast, CGNAT boundary values, IPv6 multicast/unspecified, is_blocked_ip dispatcher, malformed URL, no-host URL, unresolvable host

#440 src/metrics.rs

• Add 17 targeted unit tests covering: WebhookMetrics counter independence, histogram bucket cumulativeness, boundary/zero/overflow values; AuthMetrics all 4 counters; HorizonMetrics all 5 counters + cursor age overwrite; TrustlineMetrics record_check correctness, state replacement, asset removal, failure isolation, snapshot sort order, last_success_unix; render() trustline output for missing/present assets and check_failures

.gitignore

• Exclude tests/schema_snapshot.sql (generated, not hand-edited)
• Exclude .idea/, .vscode/, editor swap files, OS artifacts

What and why

Closes #440
Closes #441
Closes #442
Closes #443

How it was verified

• cargo test passes
• cargo fmt --check and cargo clippy --all-targets -- -D warnings pass
• New behaviour is covered by a test that fails without this change

Risk

• Adds or changes a database migration (forward-only — see DEPLOYMENT.md)
• Changes a public API response shape or error code
• Touches payment verification, settlement, or amount handling
• Touches authentication, the SSRF guard, or webhook signing
• Adds or updates a dependency (cargo deny check all passes)
• Requires a config/env change to deploy (documented in README + .env.example)

Notes for the reviewer

[drips-wave]

@edwardfavour998-code Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits