chore: bump tholos-sdk's stellar-sdk dependency to ^16.2.0

[collinsezedike]

Summary

Closes #92's follow-up (flagged in that PR's review discussion): bumps packages/tholos-sdk's @stellar/stellar-sdk dependency from ^14.5.0 to ^16.2.0.

^14.5.0 was never a deliberate pin, it was just whatever version the Stellar CLI's codegen template defaulted to when the SDK bindings were originally generated in #60. Once demos/freelance-escrow started depending on tholos-sdk directly (#92), its previous direct @stellar/stellar-sdk ^16.2.0 dependency got dropped as redundant, and the transitive version resolved down to tholos-sdk's older ^14.5.0 pin instead. Tested whether bumping would actually break anything before doing it; it doesn't.

Bonus: demos/freelance-escrow's tholos bundle chunk shrinks from 1,735 kB to 369 kB (480 kB to 98 kB gzipped) with the newer version, apparently from cleaner tree-shaking.

Test plan

• pnpm build (tsc) passes in packages/tholos-sdk from a clean install against ^16.2.0
• pnpm lint and pnpm build both pass in demos/freelance-escrow from a clean install against the bumped SDK, with no code changes needed on either side
• Launched the dev server and drove it with a headless browser: renders identically to before the bump, zero console/runtime errors
• CONTRACT.md / scripts/testnet-smoke.sh — not applicable, this only touches a JS dependency version