Fix flaky system specs and upgrade Rails to 8.1.3.1

[rodrigovirgilio]

Description

Two unrelated pieces of CI hardening in a single branch: fixes for intermittently failing system specs, and an upgrade of Rails to a supported release so Brakeman CI stops failing.

Flaky system specs

spec/system/account_request_system_spec.rb
The test asserted expect { click_button "Submit" }.to change(AccountRequest, :count).by(1), but the count was read before the async form submission had been processed by the server, so the change was reported as 0. The assertion now clicks the button, waits for the redirect (Request Received!), and only then asserts the record count.

spec/system/partner_system_spec.rb (partner group "deadline and reminder form" shared examples)
click_on "Edit" could run before the Groups tab-pane was actually displayed, raising Capybara::ElementNotFound. The preceding has_content? check was a false positive because the group name also appears in the (visible) Partners tab. The wait and click are now scoped with within "#nav-partner-groups", so the test waits for the tab to be shown before interacting with it.

Rails upgrade

Brakeman CI began failing after the bump to Brakeman 8.0.5: the EOLRails check flags Rails 8.0.2.1 because support for the 8.0.x line ends on 2026-10-07 (within Brakeman'"'"'s 60-day warning window). Upgrading to the latest stable patch, Rails 8.1.3.1, resolves the warning — the report goes back to 0 warnings with the existing config/brakeman.ignore untouched.

The upgrade surfaced a handful of spec regressions caused by Rails 8.1 behavior changes, all fixed:

• spec/requests/distributions_requests_spec.rb — a multiparameter date assignment used nil for the missing day component, which now raises NoMethodError: undefined method '"'"'empty?'"'"' for nil (known Rails issue, Gracefully handle nil during multi-parameter assignment rails/rails#57271). A real browser submits an empty string, so the spec now uses "", which both versions handle identically.
• spec/services/calendar_service_spec.rb — Rails 8.1 added a time zone to ActiveSupport::TimeZone::MAPPING (America/Asuncion), so the expected count is updated from 151 to 152.
• spec/requests/requests_requests_spec.rb — the "does not display the Cancel button" spec selected the first <button> on the page, which is now Turbo'"'"'s "Copy as text" button. The selector now targets the actual Cancel form (button[data-disable-with="Please wait..."] / input[value="Cancel"]).

Type of change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

Full suite: bundle exec rspec → 2874 examples, 3 failures. The 3 failures are the pre-existing local-only county-ordering specs (export_partners_csv_service_spec.rb, partners_requests_spec.rb:197) caused by the local Postgres C collation; they pass in CI on postgres:12.3. No failures remain from the Rails upgrade.

• bundle exec rspec spec/system/account_request_system_spec.rb → 4 examples, 0 failures (repeated runs)
• bundle exec rspec spec/system/partner_system_spec.rb → 47 examples, 0 failures
• bundle exec brakeman → 0 security warnings
• bundle exec rubocop spec/system/account_request_system_spec.rb spec/system/partner_system_spec.rb → no offenses