Pin exact dependency versions for critical packages

[AbelOsaretin]

What

All dependencies use caret ranges (^). A compromised or buggy minor version could be silently pulled in during bun install.

Why

Supply-chain attacks often target popular packages with malicious minor/patch releases. Pinning critical packages prevents silent upgrades.

Scope

• Pin @stellar/stellar-sdk to exact version
• Pin express to exact version
• Pin security-sensitive packages to exact versions
• Document the pinning strategy

Acceptance Criteria

• Critical packages pinned to exact versions in package.json
• bun.lock reflects pinned versions
• Documentation explains which packages are pinned and why

Technical Context

• package.json:12-16 — dependencies with caret ranges
• @stellar/stellar-sdk, express, dotenv are critical
• bun.lock ensures reproducibility regardless