AO3-6001 Derive subscribable type from param name server-side

[pmonfort]

Pull Request Checklist

• Have you read "How to write the perfect pull request"?
• Have you read the contributing guidelines?
• Have you added tests for any changed functionality?
• Have you added the Jira issue number as the first thing in your pull request title (e.g. AO3-1234 Fix thing)
• Do you have fewer than 5 pull requests already open? If not, please wait until they are reviewed and merged before creating new pull requests.

Issue

https://otwarchive.atlassian.net/browse/AO3-6001

Purpose

When a browser auto-translates a page, hidden fields containing class names like "User" can be translated (e.g. "用户" in Chinese), causing a NameError crash when the form is submitted.

This PR removes subscribable_type and subscribable_id from the subscription form's hidden fields and replaces them with a single type-specific ID field (work_id, series_id, or user_id). The controller derives the subscribable type from the parameter name using a SUBSCRIBABLE_PARAMS mapping, so no user-supplied class name ever reaches the server.

Changes

• Controller: Replace subscription_params mass-assignment with load_subscribable, which maps work_id → Work, series_id → Series, user_id → User. Returns 422 if zero or multiple IDs are provided. Remove unused subscription_params method.
• Form: Send a single hidden_field_tag with the type-specific param name (e.g. subscription[work_id]) only for new subscriptions. No hidden fields are sent for unsubscribe (the subscription ID is in the URL).
• Specs: Add 8 controller specs for POST #create covering all three subscribable types, missing/multiple/nonexistent IDs, legacy subscribable_type params, and the specific regression case (valid work_id alongside a browser-translated subscribable_type).

Testing Instructions

1. Log in and navigate to a work, series, or user page.
2. Inspect the Subscribe button, verify the hidden field is subscription[work_id] (or series_id/user_id) with a numeric value, and that no subscribable_type or subscribable_id fields exist.
3. Click Subscribe, it should work normally.
4. Use browser translation (or manually edit the DOM) to field with a translated value like "用户" alongside the valid work_id subscribing should still succeed.
5. Remove the type-specific ID field entirely and submit(no 500 error).

Credit

Pablo Monfort (he/him)