If a person asks to be referred to by female pronouns, use female pronouns (and vice versa).
Outing, in the LGBTQ community, is generally frowned upon. Which means if you are introducing Carol to Joan it isn't up to you to say "BTW, Joan used to be Bob", Joan will tell Carol when/if she wants too. And since this on-line, it's not a big deal that Joan hasn't started transitioning.
Coming to terms with who are you, when you who are doesn't meet social norms, is a long and arduous process. It is very personal, requires a lot of self-reflection and self-acceptance. Then announcing that to the world, even longer. Not everyone is accepting, or even polite. A lot of people are down right mean and nasty. So you spend time playing the "How will the take this?" and "How important is that they know" game. If you fear a negative reaction, is it something they really need to know? If Joan never meets Carol IRL, and Joan fears Carol will not be kind, then Joan may never tell Carol.
The fact that your friend has shared something so personal with you that it sounds like she has only just begun to accept herself reflects wonderfully on how much she values your friendship and how much she trusts you.