fix(modules): permit nested module params + dedupe form ID

Two fixes needed to make the live Investments toggle persist:

- Settings::PreferencesController: `permit(family: { modules: {} })`
  silently dropped all subkeys. Use explicit allowed-keys array
  derived from `Family::AVAILABLE_MODULES`.
- settings/preferences/show.html.erb: the explicit `hidden_field_tag`
  for the off-value collided IDs with DS::Toggle's checkbox; the
  resulting label/input mismatch broke click toggling. Pass `id: nil`
  to the hidden field.

Also includes db/schema.rb regenerated from the new migration, and
adds five screenshots under docs/screenshots/explore-feature-modules/
for the draft PR body.

app/controllers/settings/preferences_controller.rb

@@ -12,7 +12,8 @@ class Settings::PreferencesController < ApplicationController
   def update
     @user = Current.user
     user_params = params.permit(user: [ :preview_features_enabled ]).fetch(:user, {})
-    module_params = params.permit(family: { modules: {} }).dig(:family, :modules)
+    allowed_module_keys = Family::AVAILABLE_MODULES.map(&:to_sym)
+    module_params = params.permit(family: { modules: allowed_module_keys }).dig(:family, :modules)
 
     ActiveRecord::Base.transaction do
       @user.lock!

app/views/settings/preferences/show.html.erb

@@ -246,7 +246,7 @@
             <h5 class="text-primary"><%= t("modules.#{module_name}.title") %></h5>
             <p class="text-secondary"><%= t("modules.#{module_name}.description") %></p>
           </div>
-          <%= hidden_field_tag "family[modules][#{module_name}]", "0" %>
+          <%= hidden_field_tag "family[modules][#{module_name}]", "0", id: nil %>
           <%= render DS::Toggle.new(
                 id: "family_modules_#{module_name}",
                 name: "family[modules][#{module_name}]",

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.2].define(version: 2026_05_19_100000) do
+ActiveRecord::Schema[7.2].define(version: 2026_05_22_120000) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "pgcrypto"
   enable_extension "plpgsql"
@@ -498,7 +498,7 @@ ActiveRecord::Schema[7.2].define(version: 2026_05_19_100000) do
     t.index ["provider_key"], name: "index_debug_log_entries_on_provider_key"
     t.index ["source"], name: "index_debug_log_entries_on_source"
     t.index ["user_id"], name: "index_debug_log_entries_on_user_id"
-    t.check_constraint "level::text = ANY (ARRAY['debug'::character varying, 'info'::character varying, 'warn'::character varying, 'error'::character varying]::text[])", name: "chk_debug_log_entries_level"
+    t.check_constraint "level::text = ANY (ARRAY['debug'::character varying::text, 'info'::character varying::text, 'warn'::character varying::text, 'error'::character varying::text])", name: "chk_debug_log_entries_level"
   end
 
   create_table "depositories", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
@@ -717,6 +717,7 @@ ActiveRecord::Schema[7.2].define(version: 2026_05_19_100000) do
     t.string "default_account_sharing", default: "shared", null: false
     t.string "enabled_currencies", array: true
     t.datetime "last_sync_all_attempted_at"
+    t.string "disabled_modules", default: [], null: false, array: true
     t.check_constraint "default_account_sharing::text = ANY (ARRAY['shared'::character varying::text, 'private'::character varying::text])", name: "chk_families_default_account_sharing"
     t.check_constraint "month_start_day >= 1 AND month_start_day <= 28", name: "month_start_day_range"
   end