Fix controller tests and SQLite compatibility for defaults_diff

Test infrastructure:
- Allow www.example.com host in test env (ActionDispatch::HostAuthorization
  was blocking all integration test requests)
- Include Devise::Test::IntegrationHelpers in ActionDispatch::IntegrationTest
  so tests can sign in with sign_in(user)

Controller tests:
- Rewrite UsersControllerTest to match actual routes/actions (no new/create/
  edit/destroy); sign in as admin; test update-self rejection via turbo_stream
- Fix Default::UnitsControllerTest to sign in before requesting the index

SQLite compatibility in Unit#defaults_diff:
- Hoist the inner "units" CTE to the outer WITH RECURSIVE level (fixes nested
  WITH syntax error) — this was the existing TODO in the code
- Use Unit.joins(...) for the recursive part instead of a raw Arel::SelectManager
  so the SQLite visitor does not wrap it in parentheses inside UNION ALL
- Drop the named "units" CTE (conflicts with the table name under WITH RECURSIVE
  in SQLite); apply the user/defaults scope directly on the base case
- Qualify GROUP BY columns to avoid ambiguity when bases_units is joined
- Qualify ORDER BY :multiplier/:symbol to avoid ambiguity (Unit.ordering)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test/controllers/default/units_controller_test.rb

@@ -1,8 +1,12 @@
 require "test_helper"
 
 class Default::UnitsControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    sign_in users(:alice)
+  end
+
   test "should get index" do
-    get units_defaults_index_url
+    get default_units_url
     assert_response :success
   end
 end

test/controllers/users_controller_test.rb

@@ -2,7 +2,9 @@ require "test_helper"
 
 class UsersControllerTest < ActionDispatch::IntegrationTest
   setup do
-    @user = users(:one)
+    @admin = users(:admin)
+    @user = users(:alice)
+    sign_in @admin
   end
 
   test "should get index" do
@@ -10,39 +12,25 @@ class UsersControllerTest < ActionDispatch::IntegrationTest
     assert_response :success
   end
 
-  test "should get new" do
-    get new_user_url
-    assert_response :success
-  end
-
-  test "should create user" do
-    assert_difference("User.count") do
-      post users_url, params: { user: { email: @user.email, status: @user.status } }
-    end
-
-    assert_redirected_to user_url(User.last)
-  end
-
   test "should show user" do
     get user_url(@user)
     assert_response :success
   end
 
-  test "should get edit" do
-    get edit_user_url(@user)
-    assert_response :success
-  end
-
   test "should update user" do
-    patch user_url(@user), params: { user: { email: @user.email, status: @user.status } }
-    assert_redirected_to user_url(@user)
+    patch user_url(@user), params: { user: { status: :restricted } }, as: :turbo_stream
+    assert_equal "restricted", @user.reload.status
   end
 
-  test "should destroy user" do
-    assert_difference("User.count", -1) do
-      delete user_url(@user)
-    end
+  test "should not update self" do
+    patch user_url(@admin), params: { user: { status: :active } }, as: :turbo_stream,
+      headers: { "HTTP_REFERER" => users_url }
+    assert_response :redirect
+  end
 
-    assert_redirected_to users_url
+  test "should forbid non-admin" do
+    sign_in @user
+    get users_url
+    assert_response :forbidden
   end
 end