chore(deps): bump ws override to 8.21.0 (GHSA-96hv-2xvq-fx4p)

[haksungjang]

Summary

Clears Dependabot alert #69 — CVE-2026-48779 / GHSA-96hv-2xvq-fx4p (high): memory-exhaustion DoS in ws from tiny fragments and data chunks, vulnerable range >= 8.0.0 < 8.21.0.

• ws reaches the frontend only as a dev-time transitive of jsdom (test environment); it is not shipped to production bundles.
• The version is pinned by the existing overrides block in apps/frontend/package.json, so the fix is a one-line override bump 8.20.1 → 8.21.0 plus the matching lockfile entry (6-line lockfile diff, nothing else moves).

Supply-chain check

• 8.21.0 is the advisory's designated first patched version, published 2026-05-22 (~8 weeks before this PR — past the freshness caution window).
• No advisories against 8.21.0 itself (Snyk clean); ws was not among the packages hit in the recent npm supply-chain campaigns.

Verification

• npm ls ws → 8.21.0 overridden via jsdom.
• Frontend unit tests could not be exercised locally (local Node v26.4 breaks jsdom's localStorage in vitest for all 157 test files, with and without this change — CI runs Node 20 where main is green). The CI frontend-test job on this PR is the authoritative check.