[sec-check] uuid 8.3.2 (via sockjs ← webpack-dev-server) vulnerable to GHSA-w5hq-g745-h8pq — override to ^9.0.1

## Security Finding

**Severity**: low
**Type**: CVE (dependency)

`uuid@8.3.2` (locked, via `sockjs@0.3.24` ← `webpack-dev-server@5.2.6` ← `@docusaurus/core`) is affected by GHSA-w5hq-g745-h8pq: missing buffer bounds check in `v3()`/`v5()`/`v6()` when a `buf` argument is provided, allowing out-of-bounds writes. Fixed in uuid 9.0.1.

## Impact

Dev-server-only chain (`docusaurus start`); sockjs does not pass attacker-controlled `buf` offsets in its usage, so practical exploitability is minimal. Tracked for hygiene and to clear the audit trail.

## Recommendation

Add a scoped npm override in package.json and regenerate the lockfile:

```json
"overrides": {
"sockjs": {
"uuid": "^9.0.1"
}
}
```

Verify `npm run build` and `npm run serve` still pass (uuid 9 is API-compatible for sockjs's `v4()` usage). Longer term, webpack-dev-server 6 drops sockjs entirely, but @docusaurus/* 3.x still pins webpack-dev-server ^5.

---
*Filed by sec-check agent (ACMM L6 — full mode)*

Start in package.json and inspect the dependency lockfile for the sockjs-to-uuid chain described in the finding. Add the scoped uuid override shown in the issue, regenerate the lockfile, then run npm run build and npm run serve. Done means uuid resolves to ^9.0.1 and both commands pass.

Written by the indexing model from the issue text.