chore(release): prepare 1.2.8 metadata and release notes

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: aSoftwareByDesignRepository

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "arbeitszeitcheck",
-  "version": "1.2.7",
+  "version": "1.2.8",
   "description": "German labor law compliant time tracking system for Nextcloud",
   "type": "module",
   "scripts": {

package.json

@@ -0,0 +1,3 @@
+# arbeitszeitcheck-1.2.8.tar.gz
+f0e2a5ab57a164fd05cd869c35b72f5a429187b5a763c530bd798463fa1c940c  arbeitszeitcheck-1.2.8.tar.gz
+752967922744afcf5bc5f4c8e32a8eea24f2837e078de7c51a8dd21c25fd15d9100415d490ae987eba702e343026137e5fcb8efb62b1c3184a0b3f97631c3677  arbeitszeitcheck-1.2.8.tar.gz

release/CHECKSUMS-1.2.8.txt

@@ -0,0 +1,16 @@
+## ArbeitszeitCheck 1.2.8
+
+### Highlights
+
+- Hardens all state-changing endpoints with Nextcloud CSRF protection while preserving read-only GET behavior.
+- Sanitizes public JSON and page-render error responses so technical exception details are not leaked to users.
+- Improves accessibility across primary app pages with consistent main landmarks, heading hierarchy, table names, live regions, focus indicators, and mobile touch targets.
+- Fixes organization-wide monthly report downloads when a preview returns no matching members with entries.
+
+### Included hardening work
+
+- Corrects unauthenticated settings updates to return HTTP 401 instead of HTTP 400.
+- Replaces raw dashboard widget exceptions with localized live-region error copy.
+- Unifies clock-in copy around "Resume after break".
+- Removes stale personal-settings placeholders and points users to the persisted in-app settings flow.
+- Confirms the hardened accessibility test suite: 455 tests and 1,652 assertions green.