Resolve backend Qodana critical and high findings (#314)

Resolve recommended-profile Critical and High findings, retain narrow analyzer exceptions, and update the edge-broker WebSocket dependency to a non-vulnerable release.

scripts/edge-agent-to-shelly-proof.mjs

@@ -144,7 +144,7 @@ function requestJson({ method = "GET", port, path: requestPath, body = null, hea
         raw += chunk;
       });
       response.on("end", () => {
-        let decoded = {};
+        let decoded;
         try {
           decoded = raw.trim() === "" ? {} : JSON.parse(raw);
         } catch {

scripts/edge-gateway-e2e.mjs

@@ -95,7 +95,7 @@ function directCaddyBaseUrl(baseUrl) {
 }
 
 function isLocalHost(hostname) {
-  const normalized = String(hostname || "").toLowerCase().replace(/^\[|\]$/g, "");
+  const normalized = String(hostname || "").toLowerCase().replace(/^\x5b|\x5d$/g, "");
   return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1";
 }
 
@@ -227,11 +227,7 @@ async function connectCurrentContainerToComposeNetwork(rootDir, composeProject)
     return true;
   }
 
-  if (/already exists|already connected/i.test(stderr)) {
-    return true;
-  }
-
-  return false;
+  return /already exists|already connected/i.test(stderr);
 }
 
 async function disconnectCurrentContainerFromComposeNetwork(rootDir, composeProject) {
@@ -833,7 +829,7 @@ async function main() {
         { timeoutMs: 180_000, message: "Gateway operation never completed through the live agent." }
       );
     } catch (error) {
-      let operationSnapshot = null;
+      let operationSnapshot;
       try {
         const operations = await apiRequest(baseUrl, "GET", `/edge-gateways/${gatewayId}/operations`, {
           token: authToken,
@@ -959,9 +955,10 @@ async function main() {
       allowFailure: true,
     }).catch(() => {});
 
-    if (gatewayId !== null && fixture?.auth_token) {
+    const fixtureAuthToken = fixture?.auth_token;
+    if (gatewayId !== null && fixtureAuthToken) {
       await apiRequest(baseUrl, "DELETE", `/edge-gateways/${gatewayId}`, {
-        token: String(fixture.auth_token),
+        token: String(fixtureAuthToken),
       }).catch(() => {});
     }