Adopt the Rails 7.0 framework defaults

[benrfairless]

What and why

Adopts the Rails 7.0 framework defaults one flag per commit, ending with config.load_defaults 7.0, mirroring how #1529 adopted the 6.1 defaults. Most flags are inert here and each commit body says why; the ones needing real thought are below.

• Closes Update morph to Rails 7.0.x with ruby 3.0.x #1355 (with Update Rails to 7.0.8.7 #1535)
• key_generator_hash_digest_class = SHA256 ships with the cookie rotator from the 7.0 upgrade guide: without it every session and remember-me cookie issued before the deploy becomes unreadable and everyone is logged out mid-soak. Remove the rotator after a soak, once live sessions have been rewritten.
• cookies_serializer = :json resolves the FIXME from the :hybrid migration, which has been rewriting Marshal cookies as JSON in production since November 2025.
• cache_format_version is the one deliberate hold-back, kept at 6.1 explicitly in application.rb: Rails 6.1 cannot read 7.0-format cache entries and production memcached outlives a cap production deploy:rollback, so the new format would break rollback during the soak. Flip it after the soak, or in the Rails 7.1 hop where the 7.0 format becomes the floor.
• raise_on_open_redirects needed one exemption: the Discourse SSO endpoint, whose whole job is redirecting to help.morph.io, gets allow_other_host: true. Everything else redirects internally (Sign out redirects to unsafe client supplied request.referer #1438 hardened the sign-out redirect separately).
• The Active Storage flags are dropped rather than enabled (Remove dead Active Storage configuration #1497 removed Active Storage).

Type of change

• Chore

How this was checked

In the containerised dev environment: CI profile 854 examples / 0 failures (coverage 81.46% against the 80.05 threshold), rubocop and haml-lint clean, srb tc unchanged at 101 (not CI-enforced), zero Rails deprecation warnings under the #1498 guard. The open-redirect flag initially broke the 22 Discourse SSO specs (tagged slow, so only the CI profile catches them), which is what prompted the allow_other_host exemption.
CodeRabbit review of the full #1534-#1537 stack diff: 0 findings.

• Ran the automated tests
• Ran /code-review (or equivalent): fixed any concerns (and rechecked), linked follow-up issues above, or noted why they are not important above
• Documentation updated, or not needed

Deploy runbook (after merge, as part of the Phase 2 deploy)

1. Deploy in a low-usage window: cap production deploy.
2. Verify GitHub sign-in explicitly (cookie serializer and key-digest change both touch session cookies).
3. Watch Sentry; cap production deploy:rollback is the fallback (rollback stays safe because cache_format_version is held at 6.1).
4. After the week-long Phase 2 soak: remove config/initializers/cookie_rotator.rb and flip cache_format_version to 7.0, or fold both into the Rails 7.1 hop (Update morph to Rails 7.1.x in staging then production #1358).

Assisted-by: OpenCode:anthropic.claude-fable-5

[ianheggie-oaf]

Approved - makes sense to me