Release v5.2.8 (#3375)

Upgrades to Better Auth 1.7, expands Custom Styles coverage of item headers, and adds a human-approval step to the AI agent's resume edits.

Breaking for self-hosters using a custom OAuth provider: the callback path changes from /api/auth/oauth2/callback/custom to /api/auth/callback/custom, and installs using OAUTH_DISCOVERY_URL need one additional UPDATE after upgrading. Both are documented in docs/self-hosting/sso.mdx.

- Better Auth 1.7, with the account issuer migration and the jwks alg/crv columns the 1.7 jwt plugin requires
- Agent edits gated behind an approval step, with crash-safe runs and context pruning
- item-header now covers every section header row on every template; adds the item-header-row part
- Fixes provider unlinking, auth error messages, and version conflicts on freshly created resumes
- New /auth/error page, translated across all 53 target locales
- DeepSeek Harness plugin moved into packages/dsh-plugin
- Dependency bumps across the workspace

vitest.shared.mts

@@ -0,0 +1,60 @@
+import type { ViteUserConfig } from "vitest/config";
+import type { VitestEnvironment } from "vitest/node";
+import { fileURLToPath } from "node:url";
+import { defineConfig } from "vitest/config";
+
+const workspaceRoot = fileURLToPath(new URL(".", import.meta.url));
+const setupFile = fileURLToPath(new URL("./vitest.setup.ts", import.meta.url));
+
+type VitestProjectOptions = {
+	name: string;
+	dirname: string;
+	environment?: VitestEnvironment;
+	plugins?: ViteUserConfig["plugins"];
+};
+
+export const createVitestProjectConfig = ({
+	name,
+	dirname,
+	environment = "node",
+	plugins = [],
+}: VitestProjectOptions) =>
+	defineConfig({
+		root: dirname,
+		envDir: workspaceRoot,
+		resolve: { tsconfigPaths: true },
+		plugins,
+		test: {
+			name,
+			environment,
+			environmentOptions: {
+				happyDOM: {
+					settings: {
+						disableJavaScriptFileLoading: true,
+						disableCSSFileLoading: true,
+						navigation: {
+							disableMainFrameNavigation: true,
+							disableChildFrameNavigation: true,
+							disableChildPageNavigation: true,
+						},
+					},
+				},
+			},
+			setupFiles: [setupFile],
+			include: ["src/**/*.{test,spec}.?(c|m)[jt]s?(x)"],
+			exclude: ["node_modules", "dist", ".output", "coverage", "reports"],
+			pool: "threads",
+			// Isolation stays on: without it, test files in a worker share one module registry, so a
+			// `vi.mock` in one file leaks into another and whichever file imported a module first wins.
+			// That made every suite mocking `@reactive-resume/env/server` order-dependent and flaky.
+			passWithNoTests: true,
+			coverage: {
+				provider: "v8",
+				reportsDirectory: "coverage",
+				reporter: ["text", "text-summary", "json-summary", "json", "lcov", "html"],
+				include: ["src/**/*.{ts,tsx}"],
+				exclude: ["src/**/*.{test,spec}.*", "src/**/*.d.ts", "src/routeTree.gen.ts"],
+				reportOnFailure: true,
+			},
+		},
+	});