Release v5.2.8 (#3375)

Upgrades to Better Auth 1.7, expands Custom Styles coverage of item headers, and adds a human-approval step to the AI agent's resume edits.

Breaking for self-hosters using a custom OAuth provider: the callback path changes from /api/auth/oauth2/callback/custom to /api/auth/callback/custom, and installs using OAUTH_DISCOVERY_URL need one additional UPDATE after upgrading. Both are documented in docs/self-hosting/sso.mdx.

- Better Auth 1.7, with the account issuer migration and the jwks alg/crv columns the 1.7 jwt plugin requires
- Agent edits gated behind an approval step, with crash-safe runs and context pruning
- item-header now covers every section header row on every template; adds the item-header-row part
- Fixes provider unlinking, auth error messages, and version conflicts on freshly created resumes
- New /auth/error page, translated across all 53 target locales
- DeepSeek Harness plugin moved into packages/dsh-plugin
- Dependency bumps across the workspace

packages/dsh-plugin/package.json

@@ -57,15 +57,15 @@
 	},
 	"devDependencies": {
 		"@deepseek-ai/cordis": "^4.0.1",
-		"@deepseek-ai/dsh-mcp-client": "^0.1.0-rc.6",
-		"@deepseek-ai/dsh-system-prompt": "^0.1.0-rc.6",
+		"@deepseek-ai/dsh-mcp-client": "^0.1.0-rc.8",
+		"@deepseek-ai/dsh-system-prompt": "^0.1.0-rc.8",
 		"@deepseek-ai/schemastery": "^3.18.1",
 		"@reactive-resume/config": "workspace:*",
 		"@reactive-resume/mcp": "workspace:*",
 		"@typescript/native-preview": "7.0.0-dev.20260707.2",
-		"tsdown": "^0.22.0",
+		"tsdown": "^0.22.14",
 		"typescript": "^7.0.2",
-		"vitest": "^4.1.10"
+		"vitest": "^4.1.11"
 	},
 	"dsh": {
 		"bundle": {