It seems I've solved the issue, sorry for interrupting.

Some details/flow which might be useful for someone:

1. First I've created fresh rails 7.0 app and added active admin and devise gems to confirm it actually works. It worked. I should definitely do this before opening the issue here
2. I've put whole Gemfile/.lock to the new app to confirm some other dependency does not break things. It worked. This confirms it's in my code
3. Because I've tried before removing any active admin dependencies and still couldn't find the core cause I've tried the other way: remove "all" the code and bring it back one by one (configs, initializers, views, whole app)

And I've found our custom controller

module ActiveAdmin
  module Devise
    class CustomPasswordsController < ::ActiveAdmin::Devise::PasswordsController

was causing the issue. The tricky part is: commenting the whole controller code (as I did before) is not enough, removing the file fixes things.

Then I was able to fix this through:

• ignoring autoloading:

# config/initializers/00_zeitwerk_ignore_active_admin_devise.rb:
Rails.autoloaders.main.ignore(
  Rails.root.join("app/controllers/active_admin/devise")
)

• require "back" in active admin initializer:

# config/initializers/active_admin.rb:
Rails.application.config.to_prepare do
  require Rails.root.join("app/controllers/active_admin/devise/custom_passwords_controller")
end