Release v5.2.8 (#3375)

Upgrades to Better Auth 1.7, expands Custom Styles coverage of item headers, and adds a human-approval step to the AI agent's resume edits.

Breaking for self-hosters using a custom OAuth provider: the callback path changes from /api/auth/oauth2/callback/custom to /api/auth/callback/custom, and installs using OAUTH_DISCOVERY_URL need one additional UPDATE after upgrading. Both are documented in docs/self-hosting/sso.mdx.

- Better Auth 1.7, with the account issuer migration and the jwks alg/crv columns the 1.7 jwt plugin requires
- Agent edits gated behind an approval step, with crash-safe runs and context pruning
- item-header now covers every section header row on every template; adds the item-header-row part
- Fixes provider unlinking, auth error messages, and version conflicts on freshly created resumes
- New /auth/error page, translated across all 53 target locales
- DeepSeek Harness plugin moved into packages/dsh-plugin
- Dependency bumps across the workspace

docs/agents/domain.md

@@ -0,0 +1,42 @@
+# Domain Docs
+
+How engineering skills consume this repository’s domain documentation.
+
+## Before exploring, read these
+
+- **`CONTEXT-MAP.md`** at repository root. It points to context-specific `CONTEXT.md` files. Read each context relevant to current work.
+- **`docs/adr/`** for system-wide decisions touching current area.
+- Context-scoped ADR directories referenced by `CONTEXT-MAP.md`.
+
+If any file does not exist, proceed silently. Do not flag absence or suggest creating it upfront. `/domain-modeling` creates domain documents lazily when terminology or decisions become settled.
+
+## File structure
+
+This repository uses a multi-context layout:
+
+```text
+/
+├── CONTEXT-MAP.md
+├── docs/adr/                    ← system-wide decisions
+├── apps/
+│   └── <context>/
+│       └── CONTEXT.md
+└── packages/
+    └── <context>/
+        ├── CONTEXT.md
+        └── docs/adr/            ← context-specific decisions
+```
+
+`CONTEXT-MAP.md` is authoritative for context boundaries. Not every app or package needs a `CONTEXT.md`; create one only when it represents a meaningful domain context.
+
+## Use glossary vocabulary
+
+When output names a domain concept—in issue titles, refactor proposals, hypotheses, or test names—use terms defined in relevant `CONTEXT.md`. Do not drift to explicitly avoided synonyms.
+
+Missing terminology signals either language foreign to project or genuine domain-model gap. Reconsider first; otherwise note gap for `/domain-modeling`.
+
+## Flag ADR conflicts
+
+If output contradicts existing ADR, surface conflict explicitly instead of silently overriding:
+
+> _Contradicts ADR-0007 (event-sourced orders), but worth reopening because…_