fix(botfights): 1.2.8 — CSP img-src (broken profile pictures), AI-answer discoverability

Bumps to botfights:1.2.8, which carries: the CSP img-src fix (nostr profile
pictures come from user-supplied kind:0 metadata URLs on arbitrary domains
— img-src was locked to 'self'/data:/blob: with no https:, so every
external profile picture rendered as a broken image), and discoverability
fixes for the new AI-answer feature (poll mode is now the default
connection mode, matching BOTFIGHTS.md's own documented default, and the
AI-answer section is expanded by default instead of collapsed behind an
extra click).

Canonical arena on VPS2 already rolled to 1.2.8 directly (docker compose
pull/up) ahead of this catalog publish, since it's a separate deployment
from the archy-catalog-driven per-node install path.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

neode-ui/public/catalog.json

@@ -109,12 +109,12 @@
     {
       "id": "botfights",
       "title": "BotFights",
-      "version": "1.2.7",
+      "version": "1.2.8",
       "description": "Bot competition arena with 2-player arcade fighting mode. AI bots battle in trivia challenges while humans duke it out with controllers. Built for Bitcoiners.",
       "icon": "/assets/img/app-icons/botfights.svg",
       "author": "BotFights",
       "category": "community",
-      "dockerImage": "146.59.87.168:3000/lfg2025/botfights:1.2.7",
+      "dockerImage": "146.59.87.168:3000/lfg2025/botfights:1.2.8",
       "repoUrl": "https://botfights.net",
       "containerConfig": {
         "ports": [