fix(deps): bump ws to 8.21.0 to clear fixable HIGH CVE failing docker-publish (#745)

ws@8.19.0 (transitive via @supabase/supabase-js -> @supabase/realtime-js)
carries GHSA-96hv-2xvq-fx4p (memory-exhaustion DoS, CVSS 7.5), fixed in
8.21.0. The docker-publish "Scan image with Trivy" step runs
severity=CRITICAL,HIGH with ignore-unfixed=true, so this fixable HIGH has
been failing the image scan on every merge to main. Force ws>=8.21.0 via an
npm override. The only remaining HIGH (xlsx) has no upstream fix and is
skipped by ignore-unfixed, so the Trivy gate should pass.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

package-lock.json

@@ -17525,9 +17525,9 @@
       }
     },
     "node_modules/ws": {
-      "version": "8.19.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz",
-      "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
+      "version": "8.21.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
+      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"

package.json

@@ -88,5 +88,8 @@
     "tailwindcss": "^4",
     "typescript": "^5",
     "vitest": "^4.0.18"
+  },
+  "overrides": {
+    "ws": "^8.21.0"
   }
 }