chore: resolve form-data, ws CVEs via resolutions/overrides

[EightRice]

Summary

Pins two transitive dependencies to patched versions, addressing Dependabot alerts. tmp was checked but is not present anywhere in this repo's dependency tree, so no action was needed for it.

• form-data — CRLF injection via unescaped multipart field/file names, GHSA-hmw2-7cc7-3qxx (high). Vulnerable: 4.0.0/4.0.2 (via axios, superagent). Patched: ^4.0.6.
• ws — memory exhaustion DoS from tiny fragments/data chunks, GHSA-96hv-2xvq-fx4p (high, CVE-2026-48779 range). Vulnerable: 8.17.1/8.18.1 (via ethers). Patched: ^8.21.1.

Both are transitive only (not direct deps), so resolutions (yarn, which CI uses) and overrides (npm) were added to package.json to force resolution. The repo has four tracked lockfiles (package-lock.json, pnpm-lock.yaml, bun.lockb, plus an untracked/gitignored yarn.lock that CI regenerates fresh on every run); all three tracked lockfiles were regenerated and now resolve to the patched versions. No direct dependency was upgraded.

Test plan

• npm install / pnpm install / bun install — all resolve cleanly; each lockfile now shows form-data@4.0.6 and ws@8.21.1
• npm audit — form-data and ws no longer appear in the vulnerability report
• yarn install && yarn test (matches CI's test.yml exactly) — 58 passing / 4 failing, identical pass/fail counts and identical failure signatures (Mongoose buffering timed out, in routes/daos.test.js) as the pre-fix baseline on origin/main. Confirmed by running the same suite before and after the dependency change — no regressions introduced by this PR.