chore: release v0.8.0

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Push <noreply@push.computer>

fix CI: pin npm to 11.5.1 for OIDC, bump to v0.7.2

OIDC trusted publishing needs npm ≥ 11.5.1. `npm@latest` shipped a
broken release missing `promise-retry`, so pin to a known-good
version instead. Bump patch so the version-check job fires.

add pagination to user-posts: --all, --cursor, --delay

user-posts now supports fetching all pages of a user's notes,
resuming from a cursor, and configurable delay between pages.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add boards command and upgrade board to REST API (See #4)

Reverse-engineered XHS board REST endpoints from frontend JS bundles:
- GET /api/sns/web/v1/board/user — list user's boards
- GET /api/sns/web/v1/board/{boardId} — get board info
- GET /api/sns/web/v1/board/note — list notes in a board

New `boards` command lists user's collection boards. `board` command
now uses REST API first with HTML scraping as fallback.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Bump version (v0.5.4)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Bump version (v0.5.3)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Bump version (v0.5.2)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fix Windows CDP fallback when Chrome is running (v0.5.1)

When Chrome is already running, the CDP fallback fails because Chrome
locks its user data directory. Instead of requiring users to close
Chrome, copy the essential profile files (Local State + Cookies DB)
to a temp directory and launch headless Chrome from there. Chrome can
still decrypt App-Bound Encrypted cookies because the same IElevator
COM service + DPAPI context is used (same binary, same OS user).

Fixes #2

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add favorites commands (v0.5.0)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Windows cookie support: CDP fallback + --cookie-string (v0.4.0)

Chrome 127+ on Windows uses App-Bound Encryption, which prevents
external tools from decrypting newer cookies (web_session).
sweet-cookie can extract a1 but not web_session, causing -101 errors.

Three-tier cookie extraction:
1. sweet-cookie (fast DB read — works on macOS, some Windows)
2. CDP fallback (launch Chrome headless, Network.getAllCookies via
   DevTools Protocol — bypasses encryption entirely)
3. --cookie-string manual fallback (paste from Chrome DevTools)

Other improvements:
- Chrome profile auto-discovery now works on Windows and Linux
- Validate both a1 AND web_session (not just a1)
- Platform-specific error messages and troubleshooting
- Handle -101 API code with actionable hints

Closes: relates to #2

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>