chore(deps): bump shell-quote to ^1.8.4 (CVE fix) (#1711)

Bumps shell-quote from ^1.8.3 to ^1.8.4 in the root and server
packages to resolve a critical security advisory. Adds an npm
override so concurrency's pinned shell-quote@1.8.3 also resolves to
a patched version, leaving no vulnerable copy in the tree.


Claude-Session: https://claude.ai/code/session_01HiccCEh9mwCfVzE8qYcop1

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

package.json

@@ -59,7 +59,7 @@
     "concurrently": "^9.2.0",
     "node-fetch": "^3.3.2",
     "open": "^10.2.0",
-    "shell-quote": "^1.8.3",
+    "shell-quote": "^1.8.4",
     "spawn-rx": "^5.1.2",
     "ts-node": "^10.9.2",
     "zod": "^3.25.76"
@@ -78,7 +78,8 @@
     "typescript": "^5.4.2"
   },
   "overrides": {
-    "get-intrinsic": "1.3.0"
+    "get-intrinsic": "1.3.0",
+    "shell-quote": "^1.8.4"
   },
   "engines": {
     "node": ">=22.7.5"