fix: pre-existing CI failures (lockfile, validator test, perf tests)

[Majormaxx]

Closes #229

---

Changes

• frontend/package-lock.json: Regenerated to match current package.json (was missing react-hook-form and had incorrect zod version)
• backend/validator/validator_test.go: Replaced invalid Stellar test address (bad checksum) with a valid keypair address
• .github/workflows/ci.yml:
  • Exclude performance tests from regular CI run (they require a running server + database)
  • Changed mobile to use npm install instead of npm ci (no lockfile in mobile)
  • Updated Node version from 18 to 22 (18 is EOL)

Root Causes

1. Frontend/Mobile/CodeQL failures: package-lock.json was out of sync with package.json after someone added react-hook-form and changed zod version without regenerating the lockfile
2. Validator test failure: IssuerAccount test address GD6WU5...FIEIF has an invalid checksum — not a real Stellar address
3. Backend timeout: Performance tests (TestLoad_*) connect to assetforge database that doesn't exist in CI, then proceed to make HTTP requests to a server that isn't running, eventually timing out at 10m
4. Mobile CI: No package-lock.json exists in mobile/ so npm ci fails

Closes: #279