fix(validation): verify Stellar address checksums

[mikemikimike]

Summary

• Replaced shape-only checks with a shared Zod schema backed by StrKey.isValidEd25519PublicKey for donor lookups, NGO lookup, stream filters, and NGO application submission and status.
• Added correctly shaped bad-checksum address coverage for each input path. The submission regression also verifies that an invalid address is not stored.

Closes #277

#277

Validation

• Updated the PR branch onto current main (f59f86cf009d9c98520e8037125e52611da0f415) with merge commit 0fcedff4702c9fc31d422b07b77b54301799188e. The merge resolves conflicts in src/routes/donors.ts and src/routes/ngos.ts, preserving checksum validation and current NGO display-name handling.
• The six checksum-specific regression tests passed. ESLint passed for all 10 PR-changed files, and git diff --check passed.
• Full npm test on clean current main: 177 passed, 46 failed. On the updated PR head: 179 passed, 46 failed, with the exact same 46 failing test names as the clean base.
• The affected route test suites (donors, ngoApplications, and streams) had 46 passed and 16 failed on the clean base; the updated head had 48 passed and 16 failed with the same failure set.
• Full npm run lint reports 10 existing findings in src/admin/dto/admin-ngos.controller.spec.ts, src/health/health.controller.ts, src/index.ts, and test/shutdown.integration.spec.ts. Targeted ESLint on all changed files passes.
• npm run typecheck and npm run build fail on the clean base and updated head with the same existing parse error at src/index.ts:111 (TS1128).
• The GitHub Actions CI run for the updated head concluded action_required before starting any jobs (0 jobs). The auto-merge check passed.

[github-actions]

Not auto-merged: @mikemikimike is not assigned to #277. The PR may only close issues you are assigned to. Ask to be assigned, or remove the closing reference.