Document npm overrides for dependency security management

[Copilot]

npm overrides in package.json force specific package versions throughout the dependency tree. Used to fix 67 security vulnerabilities (1 critical, 18 high) in transitive dependencies, resolving 87% including all critical/high severity issues.

Documentation added

• docs/npm-overrides-faq.md - Quick-start guide with examples and Q&A
• SECURITY.md - Complete override list with CVE links, audit procedures, reporting process
• docs/adr/0008-npm-overrides-for-security.md - Architecture decision record with technical rationale
• Package READMEs - Security sections for api, app, cms, shared with package-specific overrides

Example override

{
  "overrides": {
    "lodash": "^4.17.23",
    "fast-xml-parser": "^5.3.4",
    "glob": "^11.1.0"
  }
}

Forces secure versions everywhere, even when nested packages request vulnerable versions.

Why overrides vs alternatives

• Update direct deps: Insufficient - parent packages hadn't updated
• Wait for upstream: Unacceptable delay for critical vulnerabilities
• Major version upgrades: Breaking changes require separate effort (NestJS v10→v11, vue-tsc v1→v3)
• Overrides: Immediate fix, no code changes, easily reversible

Results

Severity	Fixed
Critical	1/1 (100%)
High	18/18 (100%)
Moderate/Low	37/48 (77%)
Total	56/67 (87%)

Remaining 11 moderate vulnerabilities require major version upgrades.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[ivanslabbert]

Close and delete associated branch

[MrDirkelz]

This has been fixed in a seperate PR