feat: docker image for Bitcoin Core, configured by environment

Replaces lncm/bitcoind, which pins Core 26 — a version that still has legacy
wallets, while the code that talks to it (bt's BitcoindClient) is written for
the descriptor-only behaviour of 29 and later.

The binaries are the official release build, verified by SHA-256 in the same
layer that downloads them; a version bump that forgets the checksum fails the
build instead of shipping something unverified. uid 1000 and /data/.bitcoin are
kept from the image this replaces, so an existing named volume survives the
switch without a recursive chown of a synced chain.

Verified on testnet2: regtest node healthy in ~12 s, descriptor wallet, 101
blocks mined, sendtoaddress accepted — the last one being the check for
BITCOIND_FALLBACKFEE, without which a fresh chain refuses to send.

docker-compose.yml

@@ -0,0 +1,28 @@
+services:
+  bitcoind:
+    build:
+      # Repository root, not ./docker: the Dockerfile copies ./docker/run.sh
+      # and ./docker/healthy_check.sh, and those paths are resolved against the
+      # build context.
+      context: .
+      dockerfile: ./docker/Dockerfile
+    image: registry.bitdeals.org/bitcoind
+    environment:
+      - BITCOIND_CHAIN=regtest
+      - BITCOIND_USER=CHANGE_ME
+      - BITCOIND_PASSWORD=CHANGE_ME
+      # A fresh regtest chain has no fee history, so an unqualified
+      # sendtoaddress is refused until this is set. 0.00001 BTC/kvB = 1 sat/vB.
+      - BITCOIND_FALLBACKFEE=0.00001
+      # Both are off by default and both are required by an ElectrumX in front
+      # of this node -- drop them if nothing indexes it.
+      - BITCOIND_TXINDEX=1
+      - BITCOIND_TXOSPENDERINDEX=1
+    ports:
+      # RPC controls the wallet and has no TLS -- loopback only.
+      - 127.0.0.1:18443:18443
+    volumes:
+      - btcdata:/data/.bitcoin
+
+volumes:
+  btcdata: