Stop the availability form failing in silence

Adding availability for 5:30-6:00 PM with the lesson length left on its
60-minute default saved nothing and said nothing. A window is stored as
consecutive lesson-length slots, so one that fits no lesson splits into
none: splitByDuration() returned [], createFromWindow() inserted
nothing, and addSlot() discarded the result and re-rendered the page
unchanged.

The REST endpoint already rejected that window with a 400. The admin
form checked the same rules separately, and its copy was both laxer and
mute — an unreadable date, an end before the start, and a two-day window
were bare `return`s, and it never checked offering ownership at all, so
a crafted POST could tie a slot to another instructor's offering and
inherit their price and payment routing.

Both callers now go through WindowValidator, which returns the window or
a WP_Error explaining the refusal. The endpoint returns that error as
is; the page renders its message as a notice. handleFormAction returns
a [notice, error] pair so deletes report themselves too, and a
successful add says how many slots it created.

Two failures could also go unnoticed underneath: wpdb::insert's result
was ignored, and insert_id still holds the previous statement's id after
a failed write, so a failure looked like a success — and could become
the recurrence group of a weekly series, orphaning every later
occurrence. weeks was unbounded server-side despite the form's max=52.

availability-admin.js narrows the lesson-length choices to those that
fit the window and blocks submission when none do, which is what makes
the original mistake hard to repeat. It is a convenience: the server
validates regardless.

Closes #130

templates/admin/availability.php

@@ -13,8 +13,12 @@ if (! defined('ABSPATH')) {
  * @var list<array{date: string, slots: list<\Unsupervised\Schedular\Availability\AvailabilitySlot>}> $weekDays
  * @var string $prevWeek
  * @var string $nextWeek
+ * @var string $notice Success message from the submitted action; empty when none.
+ * @var string $error  Failure message from the submitted action; empty when none.
  */
 
+use Unsupervised\Schedular\Availability\AvailabilitySlot;
+
 $baseUrl = admin_url('admin.php?page=us-availability');
 
 $deleteForm = static function (\Unsupervised\Schedular\Availability\AvailabilitySlot $slot): void {
@@ -33,9 +37,16 @@ $deleteForm = static function (\Unsupervised\Schedular\Availability\Availability
 <div class="wrap">
     <h1><?php esc_html_e('My Availability', 'unsupervised-schedular'); ?></h1>
 
+    <?php if ('' !== $notice) : ?>
+        <div class="notice notice-success is-dismissible"><p><?php echo esc_html($notice); ?></p></div>
+    <?php endif; ?>
+    <?php if ('' !== $error) : ?>
+        <div class="notice notice-error is-dismissible"><p><?php echo esc_html($error); ?></p></div>
+    <?php endif; ?>
+
     <h2><?php esc_html_e('Add Availability', 'unsupervised-schedular'); ?></h2>
     <p><?php esc_html_e('The window must start and end on the same day. It is split into bookable slots of the chosen lesson length — for example, 9:00 AM–4:00 PM with 60-minute lessons creates seven slots.', 'unsupervised-schedular'); ?></p>
-    <form method="post">
+    <form method="post" id="usc-add-availability">
         <?php wp_nonce_field('usc_availability_action'); ?>
         <input type="hidden" name="usc_action" value="add">
         <table class="form-table">
@@ -51,9 +62,20 @@ $deleteForm = static function (\Unsupervised\Schedular\Availability\Availability
                 <th><label for="duration_minutes"><?php esc_html_e('Lesson length (minutes)', 'unsupervised-schedular'); ?></label></th>
                 <td>
                     <select name="duration_minutes" id="duration_minutes">
-                        <option value="30">30</option>
-                        <option value="60" selected>60</option>
+                        <?php foreach (AvailabilitySlot::DURATION_CHOICES as $choice) : ?>
+                            <option value="<?php echo esc_attr((string) $choice); ?>" <?php selected($choice, AvailabilitySlot::DEFAULT_DURATION_MINUTES); ?>>
+                                <?php echo esc_html((string) $choice); ?>
+                            </option>
+                        <?php endforeach; ?>
                     </select>
+                    <?php
+                    // Filled and revealed by availability-admin.js when the entered
+                    // window is too short for every lesson length. The wording lives
+                    // here so it stays translatable.
+                    ?>
+                    <p class="description usc-duration-warning" id="usc-duration-warning" hidden>
+                        <?php esc_html_e('This window is too short for any lesson length. Lengthen the window or it cannot be saved.', 'unsupervised-schedular'); ?>
+                    </p>
                 </td>
             </tr>
             <tr>
@@ -73,7 +95,7 @@ $deleteForm = static function (\Unsupervised\Schedular\Availability\Availability
                     <label><input type="radio" name="recurrence" value="single" checked> <?php esc_html_e('One-off', 'unsupervised-schedular'); ?></label>
                     &nbsp;
                     <label><input type="radio" name="recurrence" value="weekly"> <?php esc_html_e('Weekly for', 'unsupervised-schedular'); ?></label>
-                    <input type="number" name="weeks" min="1" max="52" value="12" style="width:5em;"> <?php esc_html_e('weeks', 'unsupervised-schedular'); ?>
+                    <input type="number" name="weeks" min="1" max="<?php echo esc_attr((string) AvailabilitySlot::MAX_WEEKLY_OCCURRENCES); ?>" value="12" style="width:5em;"> <?php esc_html_e('weeks', 'unsupervised-schedular'); ?>
                 </td>
             </tr>
         </table>