fix(botfights): 1.2.8 — CSP img-src (broken profile pictures), AI-answer discoverability

Bumps to botfights:1.2.8, which carries: the CSP img-src fix (nostr profile
pictures come from user-supplied kind:0 metadata URLs on arbitrary domains
— img-src was locked to 'self'/data:/blob: with no https:, so every
external profile picture rendered as a broken image), and discoverability
fixes for the new AI-answer feature (poll mode is now the default
connection mode, matching BOTFIGHTS.md's own documented default, and the
AI-answer section is expanded by default instead of collapsed behind an
extra click).

Canonical arena on VPS2 already rolled to 1.2.8 directly (docker compose
pull/up) ahead of this catalog publish, since it's a separate deployment
from the archy-catalog-driven per-node install path.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app-catalog/catalog.json

@@ -109,12 +109,12 @@
     {
       "id": "botfights",
       "title": "BotFights",
-      "version": "1.2.7",
+      "version": "1.2.8",
       "description": "Bot competition arena with 2-player arcade fighting mode. AI bots battle in trivia challenges while humans duke it out with controllers. Built for Bitcoiners.",
       "icon": "/assets/img/app-icons/botfights.svg",
       "author": "BotFights",
       "category": "community",
-      "dockerImage": "146.59.87.168:3000/lfg2025/botfights:1.2.7",
+      "dockerImage": "146.59.87.168:3000/lfg2025/botfights:1.2.8",
       "repoUrl": "https://botfights.net",
       "containerConfig": {
         "ports": [

apps/botfights/manifest.yml

@@ -1,12 +1,12 @@
 app:
   id: botfights
   name: BotFights
-  version: 1.2.7
+  version: 1.2.8
   description: Bot competition arena with 2-player arcade fighting mode. AI bots battle in trivia challenges while humans duke it out with controllers. Built for Bitcoiners.
   category: community
 
   container:
-    image: 146.59.87.168:3000/lfg2025/botfights:1.2.7
+    image: 146.59.87.168:3000/lfg2025/botfights:1.2.8
     pull_policy: always
     # Auto-generated on first install (random hex, 0600, rootless-owned). The
     # 1.2.x image's server/src/middleware/jwt.ts throws at module import when

neode-ui/public/catalog.json

@@ -109,12 +109,12 @@
     {
       "id": "botfights",
       "title": "BotFights",
-      "version": "1.2.7",
+      "version": "1.2.8",
       "description": "Bot competition arena with 2-player arcade fighting mode. AI bots battle in trivia challenges while humans duke it out with controllers. Built for Bitcoiners.",
       "icon": "/assets/img/app-icons/botfights.svg",
       "author": "BotFights",
       "category": "community",
-      "dockerImage": "146.59.87.168:3000/lfg2025/botfights:1.2.7",
+      "dockerImage": "146.59.87.168:3000/lfg2025/botfights:1.2.8",
       "repoUrl": "https://botfights.net",
       "containerConfig": {
         "ports": [

scripts/image-versions.sh

@@ -90,7 +90,7 @@ FIPS_UI_IMAGE="$ARCHY_REGISTRY/fips-ui:latest"
 ROUTSTR_IMAGE="$ARCHY_REGISTRY/routstr:v0.4.3"
 
 # Community / Gaming
-BOTFIGHTS_IMAGE="$ARCHY_REGISTRY/botfights:1.2.7"
+BOTFIGHTS_IMAGE="$ARCHY_REGISTRY/botfights:1.2.8"
 
 # IndeedHub stack
 INDEEDHUB_IMAGE="$ARCHY_REGISTRY/indeedhub:1.0.0"