Remediate llm-fe npm audit critical/high vulns (#53)

Bring dependency tree from 103 vulns (4 critical / 71 high) down to 4 moderate via npm audit fix, locked transitive overrides, and a CRA-compatible brace-expansion shim. Remaining moderates need react-router v7 and leaving Create React App.

llm-fe/package.json

@@ -20,7 +20,7 @@
     "@testing-library/user-event": "^14.5.2",
     "@types/jest": "^29.5.14",
     "@types/node": "^22.10.2",
-    "axios": "^1.7.9",
+    "axios": "^1.13.2",
     "babel-loader": "^9.2.1",
     "bootstrap": "^5.3.3",
     "chroma-js": "^3.1.2",
@@ -32,11 +32,11 @@
     "react-bootstrap": "^2.10.6",
     "react-code-blocks": "^0.1.6",
     "react-github-btn": "^1.4.0",
-    "react-router-dom": "^6.28.0",
+    "react-router-dom": "^6.30.2",
     "react-scripts": "^5.0.1",
     "react-syntax-highlighter": "^15.6.1",
     "recharts": "^2.15.1",
-    "styled-components": "^6.1.14",
+    "styled-components": "6.1.15",
     "stylis-plugin-rtl": "^2.1.1",
     "web-vitals": "^4.2.4",
     "webpack": "^5.97.1",
@@ -86,5 +86,23 @@
     "react-dom": "^18.3.1",
     "react-google-recaptcha": "^3.1.0",
     "typescript": "^4.9.5"
+  },
+  "overrides": {
+    "tar": "7.5.22",
+    "underscore": "1.13.8",
+    "nth-check": "2.1.1",
+    "postcss": "8.5.25",
+    "serialize-javascript": "7.0.7",
+    "svgo": "2.8.3",
+    "sharp": "0.35.3",
+    "brace-expansion": "file:vendor/brace-expansion-compat",
+    "minimatch": "3.1.5",
+    "uuid": "11.1.1",
+    "prismjs": "1.30.0",
+    "bfj": "9.1.3",
+    "form-data": "4.0.6",
+    "ws": "8.21.1",
+    "flatted": "3.4.3",
+    "@tootallnate/once": "3.0.1"
   }
 }