Rails 8 upgrade prep: fix otp_enc_key, advance load_defaults to 7.2

[philayres]

Summary

First tranche of work for #1015 (Rails 8 + Puma 8 upgrade prep). This PR stays on Rails 7.2.3.1 - no gem version bump yet - and focuses on the pre-bump code fix plus advancing config.load_defaults from 7.0 to 7.2, per the staged plan agreed in #1015 (isolate config-default changes from the major-version bump).

Changes

1. Fixed otp_enc_key fallback (app/models/concerns/standard_authentication.rb) - Rails.application.secrets was removed from Rails; replaced with Rails.application.secret_key_base. Confirmed via spec that the old code raised NoMethodError whenever Devise.secret_key was falsy.
2. Advanced config.load_defaults 7.0 -> 7.2 (config/application.rb) - removed the now-stale new_framework_defaults_7_0.rb/new_framework_defaults_7_2.rb initializer files (superseded by the load_defaults bump); preserved the config.yjit = true setting.
3. Conservative overrides for two Rails 7.2 defaults whose risk areas aren't fully test-covered yet, pinned to pre-7.2 behaviour with tracking issues:
   • active_record.postgresql_adapter_decode_dates = false (tracked: Adopt active_record.postgresql_adapter_decode_dates = true (currently overridden to false) #1295)
   • active_job.enqueue_after_transaction_commit = :never (tracked: Adopt active_job.enqueue_after_transaction_commit = :default (currently overridden to :never) #1296)
4. Fixed a critical Active Record Encryption regression: Rails 7.1+ defaults to a SHA256-derived key for non-deterministic encrypted attributes (e.g. otp_secret, dynamic model fields marked encrypted: true). Without a fallback, all existing SHA1-encrypted production data (every user's 2FA secret) would become undecryptable. Added config.active_record.encryption.support_sha1_for_non_deterministic_encryption = true to keep SHA1 as a decrypt-only previous scheme (tracked: Migrate OTP encrypted field (otp_secret) to SHA256 hash digest #1293).
5. Audited remaining Rails 7.1/7.2 defaults (attr_readonly, default_column_serializer, cache expiration validation, security headers, HTML sanitizer vendor, autoload paths) - no further code changes needed; findings posted as a comment on Upgrade to Rails 8 #1015.

Testing

• New specs added for the otp_enc_key fallback and for SHA1-legacy-data decryption compatibility (RED/GREEN demonstrated for both).
• Targeted regression specs run clean: standard_authentication_spec.rb, user_otp_secret_decryption_spec.rb, admin_otp_secret_decryption_spec.rb, dynamic_model_encrypted_fields_spec.rb, migration generator/dynamic migration specs, Redcap job specs, tag_formatter_spec.rb, e_signature_manager_spec.rb.
• Rubocop clean on all changed files (no new offenses).

Not in scope for this PR

• Rails 8.0/Puma 8.0 Gemfile bump
• new_framework_defaults_8_0.rb
• Deploy repo (fphs-app-deploy/fphs-rails-app) review
• Full parallel test suite run (recommended before merge - see below)

Follow-up issues

• Migrate OTP encrypted field (otp_secret) to SHA256 hash digest #1293 - re-encrypt existing SHA1 data and drop the SHA1 fallback
• Adopt active_record.postgresql_adapter_decode_dates = true (currently overridden to false) #1295 - adopt postgresql_adapter_decode_dates = true once raw-SQL paths are audited
• Adopt active_job.enqueue_after_transaction_commit = :default (currently overridden to :never) #1296 - adopt enqueue_after_transaction_commit = :default once delayed_job commit-timing is validated in staging

Refs #1015