ci(security): bump explorer Next.js 14→15 + @coinbase/wallet-sdk to clear residual HIGH CVEs

[bachal-mb]

Context

Follow-up to #14. After commit af4a18d stripped bundled npm from runtime images, 3 HIGH Trivy findings remain — all in explorer app dependencies (not npm internals):

#	Package	Installed	Fixed in	Advisory
1	next	14.2.35	15.5.15 / 16.2.3	GHSA-q4gf-8mx6-v5v3
2	next	14.2.35	15.0.8+	GHSA-h25m-26qc-wcjf
3	@coinbase/wallet-sdk	4.0.3	4.3.0	GHSA-8rgj-285w-qcq4

Scope

1. @coinbase/wallet-sdk 4.0.3 → 4.3.0 — minor bump, low risk. Touch: Makalu/explorer/package.json, verify wallet connect flow still works against Coinbase Wallet.
2. Next.js 14.2.35 → 15.x — major version migration. Touch points:
   • App Router behavior changes (async cookies()/headers()/params/searchParams).
   • next/image default behavior changes.
   • React 19 peer (or stay on React 18 with --legacy-peer-deps and accept warnings).
   • next.config.js schema additions.
   • Re-run `pnpm build`, `pnpm test`, Playwright smoke against `https://makalu.litho.ai\`.
   • SSR data fetching paths in homepage (`getServerSideProps` for stats + validators) need verification.

Recommend doing the wallet-sdk bump first as a separate PR (cheap win), then scoping the Next migration as a 1–2 session effort with the Playwright smoke spec as the gate.

Acceptance

• `publish-images.yaml` run reports 0 HIGH for explorer image
• Playwright smoke spec (`e2e/`) passes against the new build
• Wallet connect flow exercised manually on Coinbase Wallet