Upgrade to .NET 8 LTS (out-of-support runtime and base image)

[devin-ai-integration]

Summary

Moves the solution from .NET 7 (out of support since May 2024) to .NET 8 LTS. This is the fix for the container base image: mcr.microsoft.com/dotnet/aspnet:7.0 no longer receives security patches and Snyk reports 184 vulnerabilities / 6 critical against it. No application code changes were needed — only TFMs, package majors, the Dockerfile, and the CI SDK version.

• TargetFramework: net7.0 -> net8.0 in all 6 projects
• Dockerfile: aspnet:7.0 / sdk:7.0 -> aspnet:8.0 / sdk:8.0
• EF Core (Core, Design, SqlServer, Tools): 7.0.10 -> 8.0.30
• Npgsql 7.0.4 -> 8.0.9; Npgsql.EntityFrameworkCore.PostgreSQL (+ .NodaTime) 7.0.4 -> 8.0.11
• AspNetCore.HealthChecks.NpgSql 7.0.0 -> 8.0.1; Microsoft.AspNetCore.OpenApi 7.0.9 -> 8.0.30
• System.Text.Json pinned to 8.0.6 (transitive 7.0.0 via Microsoft.Extensions.DependencyModel was vulnerable and never patched on the 7.0.x line)
• CI (.github/workflows/dotnet.yml): dotnet-version 6.0.x -> 8.0.x. The workflow was pinned to 6.0.x while the projects targeted net7.0, so dotnet test aborted on the runner with "You must install or update .NET" — that failure predates this PR.

Relationship to the other PR: #68 is the minimal, stay-on-.NET-7 patch upgrade that clears the same 5 high findings. This PR supersedes it. Merge either one; if #68 lands first this branch rebases cleanly (same files, higher versions).

Snyk results

snyk test --all-projects --detection-depth=4 (Snyk CLI 1.1306.4), before -> after on this branch:

Project	Before	After
src/Infrastructure	10 high, 9 medium	0
src/WebApi	11 high, 9 medium	0
tests/WebApi.Tests	7 high, 17 medium	0
others	0	0

Every dependency finding is cleared — the 5 highs plus the mediums, which were mostly .NET 7 runtime-package transitives that disappear on net8:

• SNYK-DOTNET-AZUREIDENTITY-6009155 (high, RCE)
• SNYK-DOTNET-MICROSOFTDATASQLCLIENT-6149434 (high, unprotected credential storage)
• SNYK-DOTNET-NPGSQL-6825563 (high, SQL injection)
• SNYK-DOTNET-SYSTEMDRAWINGCOMMON-3063427 (high, RCE)
• SNYK-DOTNET-SYSTEMTEXTJSON-7433719 (high, DoS)

The base-image findings (184 vulns / 6 critical on aspnet:7.0) are addressed by moving to the supported aspnet:8.0 tag; that image is not scanned in this repo's snyk test run, so verify with snyk container test mcr.microsoft.com/dotnet/aspnet:8.0 if you want a fresh count.

Behavior risk to review

The build is clean (same 3 pre-existing nullable warnings) and all 20 tests pass on net8.0, but a major-version bump carries runtime risk that unit tests do not cover:

• EF Core 8 breaking changes that matter most here: SqlQueryRaw/raw SQL and ExecuteUpdate semantics, and stricter handling of DateTime/DateOnly and enum-to-string conversions. This repo uses NodaTime types for audit timestamps, so the Npgsql 8 + NodaTime plugin pairing should be smoke-tested against a real Postgres.
• Existing migrations were generated with EF 7. They still apply, but the EF 8 model snapshot differs slightly; the next dotnet ef migrations add may emit no-op alterations. No migrations were regenerated in this PR.
• Npgsql 8 changed some connection-string and timestamp defaults (Timestamp with time zone mapping tightened in 6, retained in 8) — validate the health check and a create/read round trip via docker-compose up.
• Nothing was removed or reconfigured to make a scan pass; Microsoft.EntityFrameworkCore.SqlServer remains referenced (it is unused in code but was left in place deliberately).

Link to Devin session: https://app.devin.ai/sessions/515d976343dd48cd8c94e0ffe96bc259
Requested by: @shayanshafii

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring