Add multi-use group invite links with expiry and auto-approval on email confirmation

A studio admin can generate a shareable group invite link (e.g. for a
newsletter) from the Invites page, choosing a required expiry date. Anyone
with the link may register while it is valid, in any registration mode: the
form collects their own email, they must confirm it via the usual hashed
token, and confirming approves the account immediately — group signups never
enter the Pending Students queue.

- us_invites grows kind (personal/group) and expires_at; an explicit expiry
  wins over the personal 14-day window. Group links stay pending (multi-use)
  until revoked or expired.
- RegistrationPage: group signups create the account pending with the
  us_auto_approve marker and send the confirmation email; no auto-login.
- EmailConfirmationHandler: auto-approve accounts are approved on
  confirmation, emailed the approved notice, and redirected to a new
  us_confirmed=ready notice with a sign-in link.

Closes #77

Co-Authored-By: Claude Fable 5 <[email protected]>

src/Auth/RegistrationPage.php

@@ -19,6 +19,12 @@ class RegistrationPage {
 	/** Success signal: a self-signup was created and must confirm their email. */
 	private const RESULT_CONFIRM = 'confirm';
 
+	/**
+	 * Success signal: a group-link signup was created and must confirm their
+	 * email — confirming approves the account immediately (no admin review).
+	 */
+	private const RESULT_CONFIRM_GROUP = 'confirm_group';
+
 	public function __construct(
 		private InviteRepository $invites,
 		private PolicyRepository $policies,
@@ -56,7 +62,7 @@ class RegistrationPage {
 
 		if ( isset( $_POST['us_register'] ) && check_admin_referer( 'us_student_register' ) ) {
 			$result = $this->handleSubmit( $invite, $open );
-			if ( in_array( $result, [ self::RESULT_INVITE, self::RESULT_CONFIRM ], true ) ) {
+			if ( in_array( $result, [ self::RESULT_INVITE, self::RESULT_CONFIRM, self::RESULT_CONFIRM_GROUP ], true ) ) {
 				$successType = $result;
 			} else {
 				$error = $result;
@@ -128,8 +134,9 @@ class RegistrationPage {
 			return esc_html__( 'Please choose a password of at least 8 characters.', 'unsupervised-schedular' );
 		}
 
-		// The email is fixed by the invite when there is one; self-signups supply it.
-		if ( $inviteValid ) {
+		// The email is fixed by a personal invite; group-link signups and
+		// self-signups supply their own.
+		if ( $inviteValid && ! $invite->isGroup() ) {
 			$email = $invite->email;
 		} else {
 			$email = sanitize_email( Val::string( wp_unslash( $_POST['email'] ?? '' ) ) );
@@ -169,7 +176,7 @@ class RegistrationPage {
 
 		$this->recordAcceptances( $policyForms, (int) $userId );
 
-		if ( $inviteValid ) {
+		if ( $inviteValid && ! $invite->isGroup() ) {
 			$this->invites->markAccepted( (int) $invite->id, (int) $userId );
 
 			wp_set_current_user( (int) $userId );
@@ -178,15 +185,19 @@ class RegistrationPage {
 			return self::RESULT_INVITE;
 		}
 
-		// Self-approval: hold the account pending, email a confirmation link, and
-		// do NOT log the user in — they must confirm and be approved first.
-		$rawToken = RegistrationStatus::markPending( (int) $userId );
+		// Group-link signups and self-signups both stay pending until they
+		// confirm their email; the group link is multi-use so it is never marked
+		// accepted. A group signup auto-approves on confirmation — no admin
+		// review — while a self-signup then waits for studio approval.
+		$autoApprove = $inviteValid && $invite->isGroup();
+
+		$rawToken = RegistrationStatus::markPending( (int) $userId, $autoApprove );
 		$user     = get_user_by( 'id', (int) $userId );
 		if ( $user instanceof \WP_User ) {
 			$this->mailer->sendConfirmation( $user, $this->confirmUrl( $rawToken ) );
 		}
 
-		return self::RESULT_CONFIRM;
+		return $autoApprove ? self::RESULT_CONFIRM_GROUP : self::RESULT_CONFIRM;
 	}
 
 	/**