Fix system tests blocked by HostAuthorization and overlapping element

Two issues prevented system tests from running:

1. ActionDispatch::HostAuthorization blocked Capybara's test server
   (127.0.0.1) because it was not in the allowed hosts list. Added
   127.0.0.1 to config.hosts in test environment.

2. test_update_status_fails_for_admin_when_disallowed failed with
   ElementClickInterceptedError — an injected submit button was obscured
   by a <a class="link"> overlay. Since the test exercises server-side
   authorization (not UI), switched to a JS click via execute_script to
   bypass the visual interception.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test/system/users_test.rb

@@ -229,7 +229,7 @@ class UsersTest < ApplicationSystemTestCase
       user = User.find_by_email!(first(:link).text)
       inject_button_to first('td:not(.link)'), "update status", user_path(user), method: :patch,
         params: {user: {status: User.statuses.keys.sample}}, data: {turbo: false}
-      click_on "update status"
+      execute_script("arguments[0].click()", find_button("update status"))
     end
     assert_title 'The change you wanted was rejected (422)'
   end