Release v5.2.8 (#3375)

Upgrades to Better Auth 1.7, expands Custom Styles coverage of item headers, and adds a human-approval step to the AI agent's resume edits.

Breaking for self-hosters using a custom OAuth provider: the callback path changes from /api/auth/oauth2/callback/custom to /api/auth/callback/custom, and installs using OAUTH_DISCOVERY_URL need one additional UPDATE after upgrading. Both are documented in docs/self-hosting/sso.mdx.

- Better Auth 1.7, with the account issuer migration and the jwks alg/crv columns the 1.7 jwt plugin requires
- Agent edits gated behind an approval step, with crash-safe runs and context pruning
- item-header now covers every section header row on every template; adds the item-header-row part
- Fixes provider unlinking, auth error messages, and version conflicts on freshly created resumes
- New /auth/error page, translated across all 53 target locales
- DeepSeek Harness plugin moved into packages/dsh-plugin
- Dependency bumps across the workspace

vitest.setup.ts

@@ -16,6 +16,12 @@ afterEach(() => {
 	cleanup();
 });
 
+// Same reason as the cleanup above: RTL flips `IS_REACT_ACT_ENVIRONMENT` from its own global
+// `beforeAll`/`afterAll` hooks, which it skips without `test.globals`. Without the flag React
+// logs "The current testing environment is not configured to support act(...)" on every
+// `act()` call, so set it here instead.
+(globalThis as unknown as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+
 // jsdom polyfills for browser APIs that some libraries (cmdk, base-ui)
 // rely on but jsdom does not implement.
 if (typeof globalThis.ResizeObserver === "undefined") {