Harden booking, offering exposure, payments, and invites

Security fixes from a pen-test review (issues #31–#37):

- #31 Booking no longer trusts a client-supplied offering_id: a slot-tied
  offering is authoritative and any offering used must belong to the slot's
  instructor, closing a free/misrouted-payment bypass.
- #34 Availability slot creation rejects an offering the instructor does not
  own (AvailabilityEndpoint now takes OfferingRepository).
- #32 Offering/question/policy listing endpoints now require book_lesson
  instead of being public (no anonymous consumer exists); Offering::toArray
  also omits etransfer_email from listings as defense-in-depth.
- #33 Slots are claimed atomically (UPDATE ... WHERE is_booked = 0) before a
  lesson is inserted, preventing a double-booking race.
- #35 A single weekly booking is capped (MAX_WEEKLY_OCCURRENCES) and only
  creates lessons for slots it actually claimed.
- #36 Stripe secret/webhook keys are write-only in the settings UI and a blank
  submit keeps the stored value; secrets are never echoed back into HTML.
- #37 Pending invites expire after 14 days (Invite::isAcceptable), enforced at
  registration and surfaced on the admin invites list.

Adds BookingEndpointTest plus Invite/Offering/AvailabilityRepository coverage
and minimal WP_REST_Request/WP_REST_Response stubs. composer test (200),
lint, and cs all green.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

src/Auth/RegistrationPage.php

@@ -45,7 +45,7 @@ class RegistrationPage {
 		}
 
 		$policyForms = $this->signupPolicies();
-		$canRegister = null !== $invite && $invite->isPending();
+		$canRegister = null !== $invite && $invite->isAcceptable( current_time( 'mysql' ) );
 
 		ob_start();
 		include USC_PLUGIN_DIR . 'templates/frontend/register-page.php';
@@ -82,8 +82,8 @@ class RegistrationPage {
 	 * message string on failure.
 	 */
 	private function handleSubmit( ?Invite $invite ): string|bool {
-		if ( null === $invite || ! $invite->isPending() ) {
-			return esc_html__( 'This invitation is invalid or has already been used.', 'unsupervised-schedular' );
+		if ( null === $invite || ! $invite->isAcceptable( current_time( 'mysql' ) ) ) {
+			return esc_html__( 'This invitation is invalid, expired, or has already been used.', 'unsupervised-schedular' );
 		}
 
 		// The submit nonce is verified by the caller (render) before this runs.