fix(web): patch critical npm audit findings (shell-quote, websocket-driver)

[devin-ai-integration]

Summary

npm audit in web-front-end/react reported 2 CRITICAL vulnerabilities, both transitive under react-scripts@5.0.1 (dev tooling, not shipped bundle code):

• shell-quote@1.8.3 (via react-dev-utils, launch-editor) — GHSA-w7jw-789q-3m8p, GHSA-395f-4hp3-45gv
• websocket-driver@0.7.4 (via webpack-dev-server → sockjs → faye-websocket) — GHSA-mp7j-qc5w-4988, GHSA-xv26-6w52-cph6

Since neither is a direct dependency and react-scripts is unmaintained, this adds npm overrides in package.json:

"overrides": {
  "shell-quote": "^1.10.0",
  "websocket-driver": "^0.7.5"
}

and regenerates package-lock.json. Result: 55 → 53 vulnerabilities (0 critical). tsc --noEmit and react-scripts build pass.

Backend (traderx-monolith/requirements.txt) had no pip-audit findings, so no Python changes.

Remaining 29 HIGH findings are mostly react-scripts internals (svgo/nth-check/postcss/workbox) that need a CRA replacement (e.g. Vite) to fully resolve; ws, socket.io-parser, underscore could be overridden the same way in a follow-up.

Link to Devin session: https://app.devin.ai/sessions/a5720ccd69d54858b890135bfcbfbd48
Open in Devin Desktop: https://app.devin.ai/desktop/session/a5720ccd69d54858b890135bfcbfbd48?variant=devin
Requested by: @mbatchelor81

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Completed local browser smoke testing for the npm overrides.

CRA/HMR and realtime smoke results

• CRA compiled with shell-quote 1.10.0 and websocket-driver 0.7.5.
• Header hot-update retained selected account state; original source restored.
• Both development-server and Socket.io websocket handshakes returned 101; no SockJS/websocket errors.
• AAPL Buy 7 appeared live as Settled, increasing trades 5→6.

Before	HMR update without reload

Pre-existing findings (unchanged UI code, not caused by this PR)

Position updates append a duplicate AAPL row (70 and 77), increasing position count 4→5. The trade form also emits React heading/key warnings. Baseline comparison against main was not performed.