Fix 2 critical npm audit findings via overrides (shell-quote, websocket-driver)

[devin-ai-integration]

Summary

npm audit in web-front-end/react reported 57 vulnerabilities, 2 of them critical. Both are transitive deps pulled in by react-scripts@5.0.1 (no direct dep to bump), so this adds npm overrides in package.json to force patched versions:

"overrides": {
  "shell-quote": "^1.10.0",        // was 1.8.3 via react-dev-utils / launch-editor  (GHSA-w7jw-789q-3m8p, GHSA-395f-4hp3-45gv)
  "websocket-driver": "^0.7.5"     // was 0.7.4 via webpack-dev-server -> sockjs -> faye-websocket (GHSA-mp7j-qc5w-4988, GHSA-xv26-6w52-cph6)
}

Result: npm audit critical count 2 -> 0 (57 -> 55 total). Both packages are dev-server/tooling deps; runtime bundle is unaffected. tsc --noEmit and CI=true npm run build pass.

Remaining 29 high findings are mostly rooted in react-scripts@5.0.1 (webpack 5 toolchain) and ag-grid-community@29 and would need major upgrades — left for follow-up (see audit report in the session).

Backend (traderx-monolith/requirements.txt): pip-audit found 0 known vulnerabilities.

Link to Devin session: https://app.devin.ai/sessions/adf1be716dd24959bac9db728660e77f
Open in Devin Desktop: https://app.devin.ai/desktop/session/adf1be716dd24959bac9db728660e77f?variant=devin
Requested by: @mbatchelor81

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Local Chrome smoke test against the Python backend on this branch.

CRA dev server + dev websocket (affected by the websocket-driver override)

• Compiled successfully, no issues found.
• /ws upgraded with HTTP 101 and received hot, hash, ok frames; no sockjs/ws connection errors.

Golden path: trade creation

Buy 7 AAPL succeeded (POST 200, trade settled) and persisted after reload.
Observed: the live position feed briefly duplicated the AAPL row until reload. This PR only overrides two dev-tooling deps, so this is almost certainly pre-existing, but it was not baseline-tested on main.

Before reload: duplicate live position	After reload: correct persisted position

Devin session