Bump devise from 4.9.4 to 5.0.3

[Copilot]

Upgrades Devise to 5.0.3, which includes a security fix for a race condition in confirmable's "change email" flow (CVE-2026-32700).

Changes

• Bump devise constraint in Gemfile from ~> 4.9 to ~> 5.0
• Update Gemfile.lock to resolve devise 5.0.3 and refresh transitive dependencies (responders, rack, loofah, minitest, etc.)

Devise 5.0 breaking changes — compatibility verified

All breaking changes were audited against this app; none apply:

Breaking change	Status
Removed deprecated devise_error_messages! helper	App uses custom application/_error_messages partial
Removed deprecated :bypass option, Devise::TestHelpers, BLACKLIST_FOR_SERIALIZATION, activerecord51?	None referenced in codebase
SecretKeyFinder removed — always uses app.secret_key_base now	Rails 8 resolves this identically; config.secret_key is commented out
Default view changes (<br> → <p>, button label, data-turbo-cache → data-turbo-temporary)	All Devise views are custom-overridden
RegistrationsController requires :registerable on model	Already declared on User

---

📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.