Confirm factory users for real Devise auth in request specs and use Rails 8-compatible status and route calls to remove deprecation warnings.