feat: complete params.expect migration for remaining controllers

[mroderick]

Summary

Completes the Rails 8.0 params.expect migration by converting the remaining 6 controllers.

Motivation

This PR follows up on #2476 to complete the params.expect migration across the entire application. All controllers (except sponsors_controller with its documented exception) now use the consistent Rails 8.0 parameter handling pattern.

Changes

Controllers Migrated (6 total)

Member-Facing Controllers:

• feedback_controller - Workshop feedback submissions
• invitation_controller - Workshop invitation updates (conditional params)
• subscriptions_controller - Chapter subscription management
• terms_and_conditions_controller - Terms & conditions acceptance
• contact_preferences_controller - Mailing list preferences

Shared Logic:

• concerns/workshop_invitation_concerns - Shared invitation parameter logic (conditional params)

Pattern Examples

Simple migration:

# Before
params.require(:feedback).permit(:coach_id, :tutorial_id, :request)

# After
params.expect(feedback: [:coach_id, :tutorial_id, :request])

Conditional params (invitation_controller, workshop_invitation_concerns):

# Before
params[:workshop_invitation].present? ? params.require(:workshop_invitation).permit(:tutorial, :note) : {}

# After
if params.key?(:workshop_invitation)
  params.expect(workshop_invitation: [:tutorial, :note])
else
  {}
end

Single field extraction (subscriptions_controller):

# Before
params.require(:subscription).permit(:group_id)[:group_id]

# After
params.expect(subscription: [:group_id])[:group_id]

Testing

• ✅ All 42 controller tests passing
• ✅ All 69 related feature tests passing:
  • 16 examples: terms & conditions, contact preferences, feedback
  • 53 examples: invitation acceptance flows
• ✅ Zero regressions

Migration Status

Completed:

• ✅ All admin controllers (except sponsors_controller - documented exception)
• ✅ All member-facing controllers
• ✅ All shared concerns

Remaining with require().permit():

• admin/sponsors_controller - Uses accepts_nested_attributes_for (incompatible with params.expect, documented in code comment)

Benefits

Consistency:

• Single parameter handling pattern across entire application
• Clear exception documented in code

Maintainability:

• All new controllers can follow the same pattern
• Easier to audit parameter handling

Developer Experience:

• Consistent syntax reduces cognitive load
• Clear examples in CLAUDE.md documentation

[olleolleolle]

🚀 Huzzah!