Upgrade to Ruby 4.0.6, Rails 8.1.3.1, and latest gems

[danielmorrison]

Summary

• Ruby 4.0.2 → 4.0.6 in .ruby-version, Dockerfile (ARG RUBY_VERSION) and .circleci/config.yml. Both the ruby:4.0.6-alpine and cimg/ruby:4.0.6-node images exist.
• Rails 8.0.4 → 8.1.3.1 with config.load_defaults 8.1. I checked each 8.1 default against the app: no redirect_to, no forms or hidden fields, no order-dependent finders without a primary key, and the JSON endpoints are consumed by devices rather than embedded in HTML, so the JSON escaping changes are harmless.
• Puma 7.2 → 8.0.2. The one breaking change in Puma 8 is the default bind address moving from 0.0.0.0 to :: when a non-loopback IPv6 interface exists. Puma doesn't set IPV6_V6ONLY, so this is dual-stack on Linux. Verified locally in production mode: /up answers on both 127.0.0.1 and [::1]. Worth a glance at the Fly health check right after deploy.
• Everything else to latest: honeybadger 6.5 → 6.9, standard 1.54 → 1.56, rubocop 1.84 → 1.90, factory_bot 6.5 → 6.6, faraday, webmock, zeitwerk, rack, nokogiri, and so on. Bundler 4.0.8 → 4.0.20 in the lockfile.
• sass 1.85 → 1.103 via npm update (in range, package.json unchanged). npm run build:css still works.

Nothing was held back on purpose. rails app:update was run in a scratch copy and reviewed; it only proposes template resets that would remove this app's config (force_ssl, Action Cable origins, config.x, the API inflection), so none of it was applied.

Test plan

• bundle exec rspec on Ruby 4.0.6 (53 examples, 0 failures, no deprecation output)
• bundle exec rake standard
• Boot check: Rails 8.1.3.1 Ruby 4.0.6
• Puma 8 production-mode smoke test over IPv4 and IPv6
• CI green on GitHub Actions and CircleCI
• After deploy, Fly health check passes and the site responds

https://claude.ai/code/session_01XpsxmpLCNWZYR8kE6vhM3x