Add jscpd duplication check and merge duplicated signup spec

[diego-suarez]

Board:

• N/A — internal cleanup / tooling, no ticket.

---

Description:

• Running jscpd . over the repo found 17 clones (7.2% duplicated lines). Most are expected: doc/openapi.yaml is generated by rspec-openapi, public/*.html are Rails' self-contained error pages, and the GitHub Actions setup steps have to repeat per job.
• The one real problem: spec/requests/api/v1/users/create_spec.rb and spec/requests/api/v1/registrations/create_spec.rb both tested the same endpoint (post user_registration_path → POST /api/v1/users). The registrations spec was also mislabelled POST api/v1/users/sign_up, a route that doesn't exist.
• Merged both into spec/requests/api/v1/registrations/create_spec.rb, which matches API::V1::RegistrationsController like the sessions/ and passwords/ specs do. The more complete users/ version is the base, plus the two assertions that only the registrations spec had (valid client/access token, password-mismatch error message).
• Added jscpd to the Linters CI job so new copy/paste gets caught. .jscpd.json ignores generated/static files and fails above 1% duplicated lines. Duplication after this PR is 0.65%.

---

Notes:

• The spec couldn't be run locally (Ruby 4.0.5 not installed on the author's machine), so CI is the first run of the merged spec and RuboCop on it.
• The OpenAPI docs aren't affected: the operation summary comes from the controller action, not the spec file or describe text.
• knapsack_rspec_report.json timing entry renamed to the new spec path. It's regenerated by the Update Knapsack Report workflow anyway.
• The 1% threshold leaves about 30 lines of headroom in the template. Projects built from it will grow, which makes the percentage more lenient. Raise it in .jscpd.json if it turns out to be noisy.
• Remaining reported clones are intentional: CI setup steps across jobs, two Pundit policy specs with opposite expectations, and the user JSON assertions shared by the sessions and registrations specs.

---

Tasks:

• Merge users/create_spec.rb into registrations/create_spec.rb and delete the duplicate
• Add .jscpd.json (threshold 1%, ignore doc/openapi.yaml, public/*.html, knapsack_rspec_report.json)
• Add Check for duplicated code step to the Linters job (npx --yes jscpd@5.4.1 .)
• Document npx jscpd . in CLAUDE.md
• Merged spec passes in CI

---

Risk:

• Low — test-only and CI-only changes. The new CI step can fail PRs that add more than about 1% duplicated lines, which is intended.

---

Preview:

$ npx jscpd .
...
│ Total:     │ 161            │ 8936        │ 48167        │ 6            │ 58 (0.65%)       │ 467 (0.97%)       │
Found 6 clones.

$ npx jscpd . --threshold 0.1   # sanity check that the gate fails
ERROR: jscpd found too many duplicates (0.6%) over threshold (0.1%)
$ echo $?
1

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud