Fix double render in ApplicationController auth callbacks

[JuanVqz]

Problem

Both check_user_token and check_session_expiry in ApplicationController called render without returning, so the before_action callbacks would render the login view but still allow the action to continue executing. This causes Rails to raise AbstractController::DoubleRenderError on every unauthenticated or expired-session request.

# Before — execution continues after render
def check_user_token
  unless session[:user_token]
    render "puzzles/login"  # no return!
  end
end

Fix

Added and return to halt the callback immediately after rendering:

def check_user_token
  render "puzzles/login" and return unless session[:user_token]
end

def check_session_expiry
  if session[:expires_at].present? && Time.current > session[:expires_at]
    reset_session
    render "puzzles/login" and return
  end
  session[:expires_at] = 1.hour.from_now
end

Tests

Added a test to PuzzlesControllerTest asserting that unauthenticated requests render the login page with a 200 response instead of raising a double render error.

[JuanVqz]

CI was failing because the brakeman version does not match

https://github.com/fastruby/ruby_or_rails/actions/runs/22741750663/job/65956852118

[JuanVqz]

Superseded by #71 which addresses this and three other related bugs with a more robust design.