fix: Allow locale preview on onboarding preferences page (#682)

* fix: Allow locale preview on onboarding preferences page

When a user selects a different language on /onboarding/preferences,
the page now immediately displays in the selected language. This is
achieved by checking for a valid locale URL parameter before falling
back to the family's saved locale setting.

* fix: Harden locale param handling and restore locale in tests

- Add type check to ensure params[:locale] is a String before calling
  .to_sym, preventing 500 errors from array/hash injection attacks
- Add teardown to tests to restore original locale, preventing test
  pollution

* fix: Reload family in teardown to handle update_column

* fix: Remove edge case test that used update_column with nil locale

* fix: Simplify localize tests - rely on fixture defaults and transactional isolation

* fix: Update system test to expect Spanish button text after locale preview

* refactor: Use I18n.t for button text in system test instead of hardcoded string

---------

Co-authored-by: Claude <noreply@anthropic.com>

app/controllers/concerns/localize.rb

@@ -8,10 +8,16 @@ module Localize
 
   private
     def switch_locale(&action)
-      locale = Current.family.try(:locale) || I18n.default_locale
+      locale = locale_from_param || Current.family.try(:locale) || I18n.default_locale
       I18n.with_locale(locale, &action)
     end
 
+    def locale_from_param
+      return unless params[:locale].is_a?(String) && params[:locale].present?
+      locale = params[:locale].to_sym
+      locale if I18n.available_locales.include?(locale)
+    end
+
     def switch_timezone(&action)
       timezone = Current.family.try(:timezone) || Time.zone
       Time.use_zone(timezone, &action)

test/controllers/concerns/localize_test.rb

@@ -0,0 +1,25 @@
+require "test_helper"
+
+class LocalizeTest < ActionDispatch::IntegrationTest
+  setup do
+    sign_in users(:family_admin)
+  end
+
+  test "uses family locale by default" do
+    get preferences_onboarding_url
+    assert_response :success
+    assert_select "h1", text: /Configure your preferences/i
+  end
+
+  test "switches locale when locale param is provided" do
+    get preferences_onboarding_url(locale: "fr")
+    assert_response :success
+    assert_select "h1", text: /Configurez vos préférences/i
+  end
+
+  test "ignores invalid locale param and uses family locale" do
+    get preferences_onboarding_url(locale: "invalid_locale")
+    assert_response :success
+    assert_select "h1", text: /Configure your preferences/i
+  end
+end

test/system/onboardings_test.rb

@@ -115,7 +115,8 @@ class OnboardingsTest < ApplicationSystemTestCase
     select "DD/MM/YYYY", from: "user_family_attributes_date_format"
     select "Dark", from: "user_theme"
 
-    click_button "Complete"
+    # Button text is in Spanish due to locale preview
+    click_button I18n.t("onboardings.preferences.submit", locale: :es)
 
     # Wait for redirect to goals page to ensure form was submitted
     assert_current_path goals_onboarding_path