Magic link submission returns 400 when form is submitted empty

[BitwiseSang]

Description

Submitting the magic link form without entering a code results in a 400 response due to ActionController::ParameterMissing.

This appears to be caused by the controller using params.expect(:code), which raises when the value is an empty string, even though blank codes are otherwise handled by the authentication flow.

Steps to reproduce

1. Go to /sessions/new path
2. Enter an email address to start a new session
3. You are redirected to /sessions/magic_link
4. Submit the form without entering a verification code (i.e. press Enter immediately)

Demo

output.mp4

Observed behavior

The request fails with HTTP 400:

ActionController::ParameterMissing (param is missing or the value is empty or invalid: code)

Expected behavior

Submitting an empty code should be handled as an invalid code and follow the normal failure path as described by the invalid_code method, rather than raising and returning a 400 response.