Add group-class withdrawal deadline and kind-aware offering form

Group classes now carry an optional per-class withdrawal deadline. Up to
that day a student may withdraw themselves from the class; the withdrawal
frees the seat and voids any pending payment but never issues an account
credit. After the deadline self-withdrawal closes and a studio admin must
withdraw the student by hand (the admin path is never subject to the
deadline). A blank deadline keeps self-withdrawal open indefinitely.

Also make the Add/Edit Offering form show only the fields relevant to the
selected kind: group settings for group classes, weekly reservation for
private lessons. Progressive enhancement — without JS every field renders.

- New nullable us_offerings.withdrawal_deadline column; Offering model gains
  $withdrawalDeadline + isWithdrawalOpen().
- New student endpoint POST /enrollments/{id}/withdraw, gated by the deadline
  (403 withdrawal_closed), ownership-checked, idempotent.
- Front-end group-class page shows a Withdraw button while open.
- No USC_VERSION bump: 1.2.0 is unreleased and accumulates schema changes
  under its section, matching the scheduled-billing and credit features.

Tests: composer test (596), composer lint, composer cs all pass.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

tests/Unit/GroupClass/EnrollmentEndpointTest.php

@@ -5,6 +5,7 @@ namespace Unsupervised\Schedular\Tests\Unit\GroupClass;
 
 use Brain\Monkey\Functions;
 use Mockery;
+use Unsupervised\Schedular\GroupClass\Enrollment;
 use Unsupervised\Schedular\GroupClass\EnrollmentEndpoint;
 use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
 use Unsupervised\Schedular\GroupClass\GroupAccessRepository;
@@ -181,4 +182,74 @@ class EnrollmentEndpointTest extends TestCase
         self::assertInstanceOf(\WP_REST_Response::class, $result);
         self::assertSame(201, $result->get_status());
     }
+
+    public function testWithdrawCancelsEnrolmentAndVoidsPendingWithoutCrediting(): void
+    {
+        // No withdrawal deadline set, so withdrawal is open. current_time is 2026-07-24.
+        $this->enrollments->shouldReceive('findById')->with(3)->andReturn(new Enrollment(8, 5, 3, Enrollment::STATUS_ACTIVE, 41, 3));
+        $this->offerings->shouldReceive('findById')->with(8)->andReturn($this->offering(120.0));
+        $this->enrollments->shouldReceive('updateStatus')->once()->with(3, Enrollment::STATUS_CANCELLED)->andReturn(true);
+        $this->payments->shouldReceive('voidPending')->once()->with(41);
+
+        $result = $this->endpoint->withdraw(new \WP_REST_Request(['id' => 3]));
+
+        self::assertInstanceOf(\WP_REST_Response::class, $result);
+        self::assertSame(200, $result->get_status());
+        self::assertSame(Enrollment::STATUS_CANCELLED, $result->get_data()['status']);
+    }
+
+    public function testWithdrawRejectedAfterDeadline(): void
+    {
+        // current_time is stubbed to 2026-07-24, past the 2026-07-10 deadline.
+        $offering = new Offering(instructorId: 3, kind: Offering::KIND_GROUP_CLASS, title: 'Choir', termStart: '2026-07-01', withdrawalDeadline: '2026-07-10', id: 8);
+        $this->enrollments->shouldReceive('findById')->with(3)->andReturn(new Enrollment(8, 5, 3, Enrollment::STATUS_ACTIVE, 41, 3));
+        $this->offerings->shouldReceive('findById')->with(8)->andReturn($offering);
+        $this->enrollments->shouldReceive('updateStatus')->never();
+        $this->payments->shouldReceive('voidPending')->never();
+
+        $result = $this->endpoint->withdraw(new \WP_REST_Request(['id' => 3]));
+
+        self::assertInstanceOf(\WP_Error::class, $result);
+        self::assertSame('withdrawal_closed', $result->get_error_code());
+        self::assertSame(403, $result->error_data['withdrawal_closed']['status']);
+    }
+
+    public function testWithdrawRejectsAnotherStudentsEnrolment(): void
+    {
+        // Enrolment belongs to student 9, but the caller is student 5.
+        $this->enrollments->shouldReceive('findById')->with(3)->andReturn(new Enrollment(8, 9, 3, Enrollment::STATUS_ACTIVE, 41, 3));
+        $this->enrollments->shouldReceive('updateStatus')->never();
+
+        $result = $this->endpoint->withdraw(new \WP_REST_Request(['id' => 3]));
+
+        self::assertInstanceOf(\WP_Error::class, $result);
+        self::assertSame('forbidden', $result->get_error_code());
+        self::assertSame(403, $result->error_data['forbidden']['status']);
+    }
+
+    public function testWithdrawReturnsNotFoundForUnknownEnrolment(): void
+    {
+        $this->enrollments->shouldReceive('findById')->with(3)->andReturn(null);
+
+        $result = $this->endpoint->withdraw(new \WP_REST_Request(['id' => 3]));
+
+        self::assertInstanceOf(\WP_Error::class, $result);
+        self::assertSame('not_found', $result->get_error_code());
+        self::assertSame(404, $result->error_data['not_found']['status']);
+    }
+
+    public function testWithdrawIsIdempotentForAlreadyCancelledEnrolment(): void
+    {
+        // Already cancelled: no status change, no deadline check, no payment void.
+        $this->enrollments->shouldReceive('findById')->with(3)->andReturn(new Enrollment(8, 5, 3, Enrollment::STATUS_CANCELLED, null, 3));
+        $this->offerings->shouldReceive('findById')->never();
+        $this->enrollments->shouldReceive('updateStatus')->never();
+        $this->payments->shouldReceive('voidPending')->never();
+
+        $result = $this->endpoint->withdraw(new \WP_REST_Request(['id' => 3]));
+
+        self::assertInstanceOf(\WP_REST_Response::class, $result);
+        self::assertSame(200, $result->get_status());
+        self::assertSame(Enrollment::STATUS_CANCELLED, $result->get_data()['status']);
+    }
 }