fix: Allow locale preview on onboarding preferences page (#682)

* fix: Allow locale preview on onboarding preferences page

When a user selects a different language on /onboarding/preferences,
the page now immediately displays in the selected language. This is
achieved by checking for a valid locale URL parameter before falling
back to the family's saved locale setting.

* fix: Harden locale param handling and restore locale in tests

- Add type check to ensure params[:locale] is a String before calling
  .to_sym, preventing 500 errors from array/hash injection attacks
- Add teardown to tests to restore original locale, preventing test
  pollution

* fix: Reload family in teardown to handle update_column

* fix: Remove edge case test that used update_column with nil locale

* fix: Simplify localize tests - rely on fixture defaults and transactional isolation

* fix: Update system test to expect Spanish button text after locale preview

* refactor: Use I18n.t for button text in system test instead of hardcoded string

---------

Co-authored-by: Claude <noreply@anthropic.com>

app/controllers/concerns/localize.rb

@@ -8,10 +8,16 @@ module Localize
 
   private
     def switch_locale(&action)
-      locale = Current.family.try(:locale) || I18n.default_locale
+      locale = locale_from_param || Current.family.try(:locale) || I18n.default_locale
       I18n.with_locale(locale, &action)
     end
 
+    def locale_from_param
+      return unless params[:locale].is_a?(String) && params[:locale].present?
+      locale = params[:locale].to_sym
+      locale if I18n.available_locales.include?(locale)
+    end
+
     def switch_timezone(&action)
       timezone = Current.family.try(:timezone) || Time.zone
       Time.use_zone(timezone, &action)