ci: repair 1274 branch after main merge (restore package files, fix cancel test)

The main merge re-introduced a duplicate mysql2 override that made
package.json invalid JSON, churned package-lock.json, and left a broken
concurrent-cancel block in the integration test (duplicate promise2
declaration and dangling .set chain) that failed to compile.

Restore package.json and package-lock.json to match main and repair the
integration test so the branch diff contains only the keeper-key blast
radius change.

Generated with Codebuff 🤖
Co-Authored-By: Codebuff <noreply@codebuff.com>

Author: meem08

backend/tests/integration/streams/cancel.test.ts

@@ -169,8 +169,6 @@ describe('POST /v1/streams/:streamId/cancel', () => {
       isActive: true,
     };
 
-    // Both requests observe the active stream, so each cancels on-chain and
-    // marks the stream inactive.
     // Both requests observe the active stream, so each performs its own
     // on-chain cancel and marks the stream inactive.
     (prisma.stream.findUnique as any).mockResolvedValue(mockStream);
@@ -186,10 +184,6 @@ describe('POST /v1/streams/:streamId/cancel', () => {
       .post(`/v1/streams/${streamId}/cancel`)
       .set('Authorization', 'Bearer dummy_token')
       .send({ senderSecret: 'S_SECRET_123' });
-      .set('Authorization', 'Bearer dummy_token');
-    const promise2 = request(app)
-      .post(`/v1/streams/${streamId}/cancel`)
-      .set('Authorization', 'Bearer dummy_token');
 
     const [res1, res2] = await Promise.all([promise1, promise2]);
 
@@ -209,7 +203,6 @@ describe('POST /v1/streams/:streamId/cancel', () => {
     expect(sorobanService.cancelStream).toHaveBeenCalledTimes(2);
     expect(sorobanService.cancelStream).toHaveBeenCalledWith(BigInt(streamId), 'S_SECRET_123');
 
-    // Stream should be marked as inactive
     // Stream should be marked as inactive via the repository helper
     expect(prisma.stream.update).toHaveBeenCalledWith({
       where: { streamId: BigInt(streamId) },