Add multi-use group invite links with expiry and auto-approval on email confirmation

A studio admin can generate a shareable group invite link (e.g. for a
newsletter) from the Invites page, choosing a required expiry date. Anyone
with the link may register while it is valid, in any registration mode: the
form collects their own email, they must confirm it via the usual hashed
token, and confirming approves the account immediately — group signups never
enter the Pending Students queue.

- us_invites grows kind (personal/group) and expires_at; an explicit expiry
  wins over the personal 14-day window. Group links stay pending (multi-use)
  until revoked or expired.
- RegistrationPage: group signups create the account pending with the
  us_auto_approve marker and send the confirmation email; no auto-login.
- EmailConfirmationHandler: auto-approve accounts are approved on
  confirmation, emailed the approved notice, and redirected to a new
  us_confirmed=ready notice with a sign-in link.

Closes #77

Co-Authored-By: Claude Fable 5 <[email protected]>

src/Auth/RegistrationStatus.php

@@ -27,6 +27,12 @@ class RegistrationStatus {
 	public const META_CONFIRM_TOKEN     = 'us_email_confirm_token';
 	public const META_CONFIRM_EXPIRES   = 'us_email_confirm_expires';
 
+	/**
+	 * Set on accounts created via a group invite link: confirming the email
+	 * approves the account immediately instead of queueing it for admin review.
+	 */
+	public const META_AUTO_APPROVE = 'us_auto_approve';
+
 	/**
 	 * Hours a self-signup email-confirmation link stays valid after the account
 	 * is created. Limits the window in which a leaked link can be redeemed.
@@ -45,8 +51,10 @@ class RegistrationStatus {
 	/**
 	 * Put a freshly created user into the pending state and issue an email
 	 * confirmation token. Returns the raw token to embed in the emailed link.
+	 * With `$autoApprove` (group invite links) confirming the email approves
+	 * the account immediately — no admin review step.
 	 */
-	public static function markPending( int $userId ): string {
+	public static function markPending( int $userId, bool $autoApprove = false ): string {
 		$rawToken = wp_generate_password( 32, false );
 
 		update_user_meta( $userId, self::META_AWAITING_APPROVAL, '1' );
@@ -57,6 +65,10 @@ class RegistrationStatus {
 			gmdate( 'Y-m-d H:i:s', time() + self::EMAIL_CONFIRM_EXPIRY_HOURS * 3600 )
 		);
 
+		if ( $autoApprove ) {
+			update_user_meta( $userId, self::META_AUTO_APPROVE, '1' );
+		}
+
 		return $rawToken;
 	}
 
@@ -78,12 +90,21 @@ class RegistrationStatus {
 		delete_user_meta( $userId, self::META_AWAITING_APPROVAL );
 		delete_user_meta( $userId, self::META_CONFIRM_TOKEN );
 		delete_user_meta( $userId, self::META_CONFIRM_EXPIRES );
+		delete_user_meta( $userId, self::META_AUTO_APPROVE );
 	}
 
 	public static function isAwaitingApproval( int $userId ): bool {
 		return '1' === Val::string( get_user_meta( $userId, self::META_AWAITING_APPROVAL, true ) );
 	}
 
+	/**
+	 * Whether confirming this account's email should approve it immediately
+	 * (group invite link signups).
+	 */
+	public static function isAutoApprove( int $userId ): bool {
+		return '1' === Val::string( get_user_meta( $userId, self::META_AUTO_APPROVE, true ) );
+	}
+
 	public static function emailConfirmed( int $userId ): bool {
 		return '1' === Val::string( get_user_meta( $userId, self::META_EMAIL_CONFIRMED, true ) );
 	}