Pin shell-quote and websocket-driver to fix critical npm audit findings

[devin-ai-integration]

Summary

npm audit in web-front-end/react reported 2 CRITICAL transitive vulnerabilities, both pulled in via react-scripts@5.0.1 (webpack-dev-server / sockjs):

• shell-quote@1.8.3 — GHSA-w7jw-789q-3m8p, GHSA-395f-4hp3-45gv
• websocket-driver@0.7.4 — GHSA-mp7j-qc5w-4988, GHSA-xv26-6w52-cph6

Fixed via npm overrides (no react-scripts upgrade, no --force):

"overrides": {
  "shell-quote": "1.9.0",
  "websocket-driver": "0.7.5"
}

(1.9.0 is the lowest published shell-quote above the vulnerable <=1.8.4 range.)

Result: 57 vulnerabilities (… 2 critical) → 55 vulnerabilities (12 low, 14 moderate, 29 high, 0 critical); CI=false npm run build passes. Remaining HIGH findings are almost entirely inside the react-scripts toolchain and require a breaking upgrade (npm audit fix --force would install react-scripts@0.0.0), so they're left for a separate change.

Link to Devin session: https://app.devin.ai/sessions/20628b24798c41639f0269c1de489bbe
Open in Devin Desktop: https://app.devin.ai/desktop/session/20628b24798c41639f0269c1de489bbe?variant=devin
Requested by: @mbatchelor81

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Local smoke test with the dependency overrides:

• React dev server compiled; its /ws connection returned 101 with hot/liveReload/ok messages (websocket-driver path).
• Seeded trades/positions loaded from the backend; creating AAPL Buy 7 via the UI delivered a Settled trade and updated position (77) over socket.io without refresh.

Before: seeded data	After: socket-delivered update

Caveats

Pre-existing (not related to this change, not compared against base): the position grid shows stale AAPL 70 alongside new AAPL 77; React logs DOM-nesting/key-spread warnings. Source-edit HMR was not exercised.