Bump langsmith to 0.5.20 and override @langchain/classic to fix CVE

langsmith <=0.5.18 leaks streamed LLM output past redaction controls
(GHSA-rr7j-v2q5-chgv). The transitive pin via @n8n/ai-utilities held
@langchain/classic at 1.0.5 which required langsmith ^0.3.64, blocking
the upgrade. Add npm overrides for @langchain/classic (^1.0.27) and
langsmith (^0.5.19) to resolve all three langsmith advisories.

The lockfile refresh bumps eslint-plugin-react-hooks from 7.0.1 to
7.1.0 which enables the react-hooks/refs and set-state-in-effect
rules. Fix the resulting lint errors:

- PDFPreview (console + trust): read currentPage through a ref synced
  via useEffect, keeping the setState updater pure and ref access
  outside of render
- MeasuresPage: remove redundant categoryFilter state that mirrored
  urlCategory, use a ref to detect URL changes and trigger refetch
  as the single source of category refetches
- WebhooksSettingsPage: defer loadEvents via requestAnimationFrame
  to avoid synchronous setState within the effect body

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

package.json

@@ -31,7 +31,8 @@
       "brace-expansion": "^1.1.11"
     },
     "minimatch@9": "^9.0.9",
-    "langsmith": "^0.5.0",
+    "@langchain/classic": "^1.0.27",
+    "langsmith": "^0.5.19",
     "handlebars": "4.7.9",
     "@langchain/community": "^1.1.25",
     "lodash": "^4.18.1",