Fix system tests blocked by HostAuthorization and overlapping element

Two issues prevented system tests from running:

1. ActionDispatch::HostAuthorization blocked Capybara's test server
   (127.0.0.1) because it was not in the allowed hosts list. Added
   127.0.0.1 to config.hosts in test environment.

2. test_update_status_fails_for_admin_when_disallowed failed with
   ElementClickInterceptedError — an injected submit button was obscured
   by a <a class="link"> overlay. Since the test exercises server-side
   authorization (not UI), switched to a JS click via execute_script to
   bypass the visual interception.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

config/environments/test.rb

@@ -58,4 +58,7 @@ Rails.application.configure do
   # config.action_view.annotate_rendered_view_with_filenames = true
 
   config.log_level = :info
+
+  # Allow Capybara's dynamic test server host (127.0.0.1:<random_port>)
+  config.hosts << '127.0.0.1'
 end