There is a lot of victim blaming going on & a lot of posters that don’t seem to have experience of teenage girls.
1 You should definitely email the school about this today. Copy in her class teacher, head of year 7, head of year 8, safe guarding lead, pastoral lead and any other person that sound appropriate. They won’t necessarily be able to tackle it over the holidays but maybe get a plan in place for September.
2 Back up any voice messages & screenshot any text exchanges. Then block Cece on DD’s phone.
3 Put some effort into helping DD with her friends over the holidays (not saying you don’t already). Obviously they are too old for you to arrange ’playdates’ but she could invite them round for a movie night with pizza, or she could invite a friend on a day out to a theme park or cinema. I would avoid her ‘hanging out’ at the park or shops with them in case Cece turned up. Encourage her to invite her friends to hang out at your place instead & stock up the snack cupboard.
Finally, you didn’t do the wrong thing speaking to the other mum. I would have done the same. Most parents of 12y olds would want to know if their kids were being given vapes by an older child.
I wouldn’t go to the police yet, as they are unlikely to do anything at this point. I would put in the email to the school as a question, something like ‘do they think you should report it to the police now?’, so they realise it is an option you are prepared to take.
Best of luck.