fix(deps): patch critical shell-quote and websocket-driver CVEs in React frontend

[devin-ai-integration]

Summary

npm audit on web-front-end/react reported 2 critical vulnerabilities, both transitive via react-scripts@5.0.1:

• shell-quote@1.8.3 (via react-dev-utils, launch-editor) — GHSA-w7jw-789q-3m8p (newline escaping), GHSA-395f-4hp3-45gv (quadratic DoS in parse())
• websocket-driver@0.7.4 (via webpack-dev-server → sockjs → faye-websocket) — GHSA-mp7j-qc5w-4988, GHSA-xv26-6w52-cph6

react-scripts is unmaintained, so the fix is an npm overrides block in package.json pinning both to patched ranges (shell-quote@^1.8.5 → resolves 1.10.0, websocket-driver@^0.7.5), with package-lock.json regenerated accordingly.

Result: npm audit criticals 2 → 0 (57 → 55 total). tsc --noEmit and npm run build pass. Remaining highs are mostly react-scripts internals (svgo/nth-check/postcss/serialize-javascript) that only resolve via a breaking react-scripts change, plus ag-grid-community (direct, upgrade to 36.x is a major bump) — left out of scope.

Backend (traderx-monolith/requirements.txt): pip-audit found 0 vulnerabilities (requirements are unpinned, so it resolves to current releases).

Link to Devin session: https://app.devin.ai/sessions/cf9ba4b3987d4587837d303aa920e33b
Open in Devin Desktop: https://app.devin.ai/desktop/session/cf9ba4b3987d4587837d303aa920e33b?variant=devin
Requested by: @mbatchelor81

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Local dependency smoke test

Browser smoke assertions passed using Node 20 and the real local monolith:

• Dev server compiled without errors (webpack compiled successfully).
• Selecting account #22214 rendered 5 trades and 4 positions with the expected seeded values.
• No browser websocket/HMR or runtime errors.
• Dev /ws returned HTTP 101 and delivered hot, liveReload, hash, ok messages (exercises the overridden websocket-driver).

Transport evidence and coverage limits

Console	Development websocket

Not exercised: source-edit hot reload, SockJS fallback, trade creation.

Written by Devin