feat: keep code of conduct dms and the web page in sync

[jaspermayone]

Summary

Accepting the code of conduct in one place now updates the other place.

• Web → Slack: when someone accepts on /slack (for example from the email), every code-of-conduct DM they got is replaced with a thank-you.
• Slack → web: when someone has /slack open and accepts in Slack, the page reloads to show the new step.

This also fixes the case where a person got two DMs and the second one kept a live button after they accepted in the first.

sequenceDiagram
  participant S as SlackService
  participant U as users.slack_coc_messages
  participant J as SlackCodeOfConductAcceptedJob
  participant P as /slack page
  S->>U: post_code_of_conduct remembers {channel, ts}
  Note over J: accepted in Slack or on /slack
  J->>U: take all remembered DMs (row lock), clear
  J->>S: chat.update each DM with the thank-you
  P->>P: polls GET /slack/status every 5 s
  P->>P: step changed: reload

Loading

Changes

• New column users.slack_coc_messages (jsonb, default []).
• SlackService#post_code_of_conduct remembers each DM it sends. User#remember_code_of_conduct_message! appends in SQL, so two DMs sent at once are both kept.
• SlackCodeOfConductAcceptedJob promotes first (for guests), then replaces every remembered DM plus the DM the acceptance came from. One failed update does not stop the others. User#take_code_of_conduct_messages! reads and clears the list under a row lock. It does not use with_lock, because User#lock! locks the account.
• New GET /slack/status returns { "step": ... }. A new Stimulus controller (onboarding-status) polls it every 5 seconds on the invite, accept and promotion steps, while the tab is visible, for at most 10 minutes. It reloads the page when the step changes.

Not covered

An email cannot be edited after it is sent. The "Sign in and accept" link still works after acceptance, and /slack then shows the person as done.

Test plan

• bundle exec rspec, bin/rails test, bin/rubocop
• Staging: send a DM to the sandbox account, accept on /slack, and check that the DM changes.
• Staging: open /slack, accept in Slack, and check that the page reloads.

This PR has a migration.