Release 2.8.0 step 1: bump version to 2.8.0 on v2/main

[cliffhall]

Step 1 of the v2.8.0 release, per the release skill.

The bump goes on v2/main before the milestone merge (#2010), so the release lands on main with the version already correct and v2/main is never left behind main.

Scope of this PR — all three parts of release prep, in one change:

1. npm audit --audit-level=high across the root and all four client installs, as a report. Anything it names is fixed deliberately — a direct bump or an overrides entry — never with npm audit fix (High-severity nanoid advisory in the production tree (via vite → postcss), on both branches #2058).
2. Any fixes that audit forces, each as its own commit.
3. npm version minor --no-git-tag-version → 2.7.0 → 2.8.0. --no-git-tag-version is load-bearing: the release tag must point at the merge commit on main, not at a v2/main commit.

Verified by npm run local:gate.

[cliffhall]

Shipped in PR #2454 (merged as dcc43ad). v2/main now reads 2.8.0. Step 2 is #2455.