fix(botfights): 1.2.8 — CSP img-src (broken profile pictures), AI-answer discoverability

Bumps to botfights:1.2.8, which carries: the CSP img-src fix (nostr profile
pictures come from user-supplied kind:0 metadata URLs on arbitrary domains
— img-src was locked to 'self'/data:/blob: with no https:, so every
external profile picture rendered as a broken image), and discoverability
fixes for the new AI-answer feature (poll mode is now the default
connection mode, matching BOTFIGHTS.md's own documented default, and the
AI-answer section is expanded by default instead of collapsed behind an
extra click).

Canonical arena on VPS2 already rolled to 1.2.8 directly (docker compose
pull/up) ahead of this catalog publish, since it's a separate deployment
from the archy-catalog-driven per-node install path.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/botfights/manifest.yml

@@ -1,12 +1,12 @@
 app:
   id: botfights
   name: BotFights
-  version: 1.2.7
+  version: 1.2.8
   description: Bot competition arena with 2-player arcade fighting mode. AI bots battle in trivia challenges while humans duke it out with controllers. Built for Bitcoiners.
   category: community
 
   container:
-    image: 146.59.87.168:3000/lfg2025/botfights:1.2.7
+    image: 146.59.87.168:3000/lfg2025/botfights:1.2.8
     pull_policy: always
     # Auto-generated on first install (random hex, 0600, rootless-owned). The
     # 1.2.x image's server/src/middleware/jwt.ts throws at module import when