Controllers

• Controllers handle HTTP only: receive request, delegate to model, return response.
• Actions should not exceed 10 lines (excluding strong params). Longer actions often signal business logic that belongs in a model or PORO.
• Maximum one instance variable per action.
• No business logic, calculations, email sending, or multi-object operations in controllers.
• Always use strong parameters. Never params.permit!.
• Return status: :unprocessable_entity on failed form renders (required by Turbo).
• Prefer RESTful routes. Custom verb actions (e.g., post "activate") usually mean a missing noun/resource (e.g., resource :trial, only: [:create]).