Add multi-use group invite links with expiry and auto-approval on email confirmation

A studio admin can generate a shareable group invite link (e.g. for a
newsletter) from the Invites page, choosing a required expiry date. Anyone
with the link may register while it is valid, in any registration mode: the
form collects their own email, they must confirm it via the usual hashed
token, and confirming approves the account immediately — group signups never
enter the Pending Students queue.

- us_invites grows kind (personal/group) and expires_at; an explicit expiry
  wins over the personal 14-day window. Group links stay pending (multi-use)
  until revoked or expired.
- RegistrationPage: group signups create the account pending with the
  us_auto_approve marker and send the confirmation email; no auto-login.
- EmailConfirmationHandler: auto-approve accounts are approved on
  confirmation, emailed the approved notice, and redirected to a new
  us_confirmed=ready notice with a sign-in link.

Closes #77

Co-Authored-By: Claude Fable 5 <[email protected]>

tests/Unit/Auth/RegistrationStatusTest.php

@@ -42,10 +42,41 @@ class RegistrationStatusTest extends TestCase
         Functions\expect('delete_user_meta')->once()->with(7, RegistrationStatus::META_AWAITING_APPROVAL);
         Functions\expect('delete_user_meta')->once()->with(7, RegistrationStatus::META_CONFIRM_TOKEN);
         Functions\expect('delete_user_meta')->once()->with(7, RegistrationStatus::META_CONFIRM_EXPIRES);
+        Functions\expect('delete_user_meta')->once()->with(7, RegistrationStatus::META_AUTO_APPROVE);
 
         RegistrationStatus::approve(7);
     }
 
+    public function testMarkPendingWithAutoApproveSetsMarkerMeta(): void
+    {
+        Functions\when('wp_generate_password')->justReturn('rawtoken');
+
+        Functions\expect('update_user_meta')
+            ->once()
+            ->with(7, RegistrationStatus::META_AWAITING_APPROVAL, '1');
+        Functions\expect('update_user_meta')
+            ->once()
+            ->with(7, RegistrationStatus::META_CONFIRM_TOKEN, hash('sha256', 'rawtoken'));
+        Functions\expect('update_user_meta')
+            ->once()
+            ->with(7, RegistrationStatus::META_CONFIRM_EXPIRES, \Mockery::type('string'));
+        Functions\expect('update_user_meta')
+            ->once()
+            ->with(7, RegistrationStatus::META_AUTO_APPROVE, '1');
+
+        self::assertSame('rawtoken', RegistrationStatus::markPending(7, true));
+    }
+
+    public function testIsAutoApproveReadsMeta(): void
+    {
+        Functions\when('get_user_meta')->alias(static function (int $id, string $key) {
+            return $key === RegistrationStatus::META_AUTO_APPROVE ? '1' : '';
+        });
+
+        self::assertTrue(RegistrationStatus::isAutoApprove(7));
+        self::assertFalse(RegistrationStatus::isAwaitingApproval(7));
+    }
+
     public function testAwaitingApprovalAndEmailConfirmedReadMeta(): void
     {
         Functions\when('get_user_meta')->alias(static function (int $id, string $key) {