feat(web): finalize Discord OAuth and platform-agnostic auth

- Bump version to 2.8.0 across all versioned files
- Fix AuthorizedSessionServiceTests for platform-agnostic identity
- Update Razor Pages to use *ForCurrentUserAsync APIs
- Add backward-compatible constructors to WebGameGroup/WebGroupManager
- Make DiscordOAuthOptions properties non-required for config binding

Bump version → 2.8.0

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/GmRelay.Web/Components/Pages/GroupStats.razor

@@ -5,7 +5,7 @@
 @using Microsoft.AspNetCore.Components.Authorization
 @using System.Security.Claims
 @attribute [Authorize]
-@inject ISessionStore SessionStore
+@inject AuthorizedSessionService SessionService
 @inject AuthenticationStateProvider AuthStateProvider
 @inject NavigationManager Navigation
 
@@ -85,9 +85,9 @@
                                 <td>
                                     <div class="player-info">
                                         <span class="player-name">@s.DisplayName</span>
-                                        @if (!string.IsNullOrEmpty(s.TelegramUsername))
+                                        @if (!string.IsNullOrEmpty(s.ExternalUsername))
                                         {
-                                            <span class="player-username">@@@s.TelegramUsername</span>
+                                            <span class="player-username">@@@s.ExternalUsername</span>
                                         }
                                     </div>
                                 </td>
@@ -171,21 +171,20 @@
             Navigation.NavigateTo("/login");
             return;
         }
-        var telegramIdClaim = user.FindFirst("telegram_id")?.Value
-            ?? user.FindFirst(ClaimTypes.NameIdentifier)?.Value;
-        if (!long.TryParse(telegramIdClaim, out var telegramId))
+        if (!user.TryGetPlatformIdentity(out var platform, out var externalUserId))
         {
             Navigation.NavigateTo("/login");
             return;
         }
         try
         {
-            if (!await SessionStore.IsGroupManagerAsync(GroupId, telegramId))
+            var groupManagement = await SessionService.GetGroupManagementForCurrentUserAsync(GroupId);
+            if (groupManagement is null)
             {
                 Navigation.NavigateTo("/access-denied");
                 return;
             }
-            stats = await SessionStore.GetGroupAttendanceStatsAsync(GroupId) ?? new();
+            stats = await SessionService.GetGroupAttendanceStatsForCurrentUserAsync(GroupId) ?? new();
             UpdateSortedStats();
         }
         catch (Exception ex)