Upgrade to .NET 8 and remediate high-severity dependency vulnerabilities

[devin-ai-integration]

Summary

Remediates the 5 high-severity open-source findings from the Snyk audit. All of them (System.Text.Json 7.0.0, Azure.Identity 1.6.0, Microsoft.Data.SqlClient 5.0.2, System.Drawing.Common 5.0.0, Npgsql 7.0.4) were transitive, so the fix is a framework/provider bump plus removing one unused provider — not five direct pins.

Changes:

• net7.0 -> net8.0 in all 6 projects; Dockerfile aspnet:7.0/sdk:7.0 -> 8.0 (also moves the runtime image off the Debian 11 base with the openssl/perl-base/pam/systemd OS vulns).
• EF Core + Microsoft.AspNetCore.OpenApi 7.0.x -> 8.0.11, Npgsql 8.0.8, Npgsql EF provider (+NodaTime) 8.0.11, AspNetCore.HealthChecks.NpgSql 8.0.2. EF pinned to 8.0.11 rather than the newest 8.0.x patch to match the assembly version the Npgsql provider references (mixing 8.0.29 produced MSB3277 EntityFrameworkCore.Relational conflicts).
• Dropped Microsoft.EntityFrameworkCore.SqlServer — no code references SqlServer (Postgres-only app), and it was the sole path to Microsoft.Data.SqlClient -> Azure.Identity and System.Drawing.Common. This removes those three findings entirely instead of pinning patched versions of packages we don't use.
• Added an explicit System.Text.Json 8.0.5 reference in Infrastructure so the transitive 7.0.0 can't float back in.
• CI workflow setup-dotnet was pinned to 6.0.x (it only built because the runner had newer SDKs preinstalled) -> 8.0.x.

Verification: dotnet build clean (no NU1903/NETSDK1138), dotnet test 20/20 passing, snyk test --all-projects --severity-threshold=high -> 6 projects, no vulnerable paths.

Note: .NET 8 is the current LTS the audit asked for, but its support ends Nov 2026 — a follow-up move to .NET 10 LTS is worth scheduling.

Link to Devin session: https://app.devin.ai/sessions/91f2594952524217ba24fb964b49f67b
Requested by: @shayanshafii

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring