Harden booking, offering exposure, payments, and invites

Security fixes from a pen-test review (issues #31–#37):

- #31 Booking no longer trusts a client-supplied offering_id: a slot-tied
  offering is authoritative and any offering used must belong to the slot's
  instructor, closing a free/misrouted-payment bypass.
- #34 Availability slot creation rejects an offering the instructor does not
  own (AvailabilityEndpoint now takes OfferingRepository).
- #32 Offering/question/policy listing endpoints now require book_lesson
  instead of being public (no anonymous consumer exists); Offering::toArray
  also omits etransfer_email from listings as defense-in-depth.
- #33 Slots are claimed atomically (UPDATE ... WHERE is_booked = 0) before a
  lesson is inserted, preventing a double-booking race.
- #35 A single weekly booking is capped (MAX_WEEKLY_OCCURRENCES) and only
  creates lessons for slots it actually claimed.
- #36 Stripe secret/webhook keys are write-only in the settings UI and a blank
  submit keeps the stored value; secrets are never echoed back into HTML.
- #37 Pending invites expire after 14 days (Invite::isAcceptable), enforced at
  registration and surfaced on the admin invites list.

Adds BookingEndpointTest plus Invite/Offering/AvailabilityRepository coverage
and minimal WP_REST_Request/WP_REST_Response stubs. composer test (200),
lint, and cs all green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/Availability/AvailabilityRepository.php

@@ -165,14 +165,26 @@ class AvailabilityRepository {
 		return $row ? AvailabilitySlot::fromRow( $row ) : null;
 	}
 
-	public function markBooked( int $id ): bool {
-		return (bool) $this->db->update(
+	/**
+	 * Atomically claim an unbooked slot. The `is_booked = 0` guard in the WHERE
+	 * clause makes this the single point of truth for reserving a slot: only one
+	 * concurrent request can transition it from unbooked to booked, so two students
+	 * cannot book (and be charged for) the same slot. Returns true only when this
+	 * call is the one that claimed it.
+	 */
+	public function claim( int $id ): bool {
+		$updated = $this->db->update(
 			$this->table,
 			[ 'is_booked' => 1 ],
-			[ 'id' => $id ],
+			[
+				'id'        => $id,
+				'is_booked' => 0,
+			],
 			[ '%d' ],
-			[ '%d' ]
+			[ '%d', '%d' ]
 		);
+
+		return 1 === $updated;
 	}
 
 	/**