Add studio-defined account-registration questions

Studio admins can now define registration questions that every new student
answers as a required second step during signup, with each student's answers
shown under a "Registration Information" section in the admin.

Extends the existing Registration domain: us_questions gains a scope column
(offering | account) and a nullable offering_id, and account answers reuse
us_question_answers with registration_type = 'account'. Authoring reuses the
Offerings -> Questions page via an "Account signup" scope (studio-admin only).
The registration form becomes two steps (progressive enhancement via
assets/js/register.js; works without JS); required answers are validated before
the account is created and apply to all signup paths (invite, group link,
self-approval). StudentHistory::registrationInfo() powers the admin section.

Bumps the plugin version to 1.1.0 so dbDelta runs the schema migration.

Closes #90

Co-Authored-By: Claude Opus 4.8 <[email protected]>

src/Auth/RegistrationPage.php

@@ -9,6 +9,10 @@ use Unsupervised\Schedular\Policy\Policy;
 use Unsupervised\Schedular\Policy\PolicyAcceptance;
 use Unsupervised\Schedular\Policy\PolicyRepository;
 use Unsupervised\Schedular\Policy\PolicyVersionRepository;
+use Unsupervised\Schedular\Registration\Answer;
+use Unsupervised\Schedular\Registration\AnswerRepository;
+use Unsupervised\Schedular\Registration\Question;
+use Unsupervised\Schedular\Registration\QuestionRepository;
 use Unsupervised\Schedular\Val;
 
 class RegistrationPage {
@@ -32,6 +36,8 @@ class RegistrationPage {
 		private AcceptanceRepository $acceptances,
 		private StudioSettings $settings,
 		private RegistrationMailer $mailer,
+		private QuestionRepository $questions,
+		private AnswerRepository $answers,
 	) {}
 
 	/**
@@ -76,8 +82,14 @@ class RegistrationPage {
 		// Where the post-confirmation prompt sends students to sign in.
 		$loginUrl = $this->loginUrl( Val::int( $atts['loginPageId'] ?? $atts['login_page_id'] ?? 0 ) );
 
-		$policyForms = $this->signupPolicies();
-		$canRegister = $open || $inviteValid;
+		$policyForms      = $this->signupPolicies();
+		$accountQuestions = $this->questions->findByScope( Question::SCOPE_ACCOUNT, activeOnly: true );
+		$canRegister      = $open || $inviteValid;
+
+		// The two-step script only matters when there is a second step to reveal.
+		if ( $canRegister && '' === $successType && [] !== $accountQuestions ) {
+			wp_enqueue_script( 'us-scheduler-register' );
+		}
 
 		ob_start();
 		include USC_PLUGIN_DIR . 'templates/frontend/register-page.php';
@@ -156,6 +168,17 @@ class RegistrationPage {
 			}
 		}
 
+		// Account-signup questions (step two) — validate before creating the user so
+		// a missing required answer never leaves a half-registered account behind.
+		$accountQuestions = $this->questions->findByScope( Question::SCOPE_ACCOUNT, activeOnly: true );
+		$answers          = $this->submittedAnswers();
+
+		foreach ( $accountQuestions as $question ) {
+			if ( $question->isRequired && '' === trim( (string) ( $answers[ (int) $question->id ] ?? '' ) ) ) {
+				return esc_html__( 'Please answer all required registration questions.', 'unsupervised-schedular' );
+			}
+		}
+
 		if ( email_exists( $email ) ) {
 			return esc_html__( 'An account already exists for this email.', 'unsupervised-schedular' );
 		}
@@ -175,6 +198,7 @@ class RegistrationPage {
 		}
 
 		$this->recordAcceptances( $policyForms, (int) $userId );
+		$this->recordAnswers( $accountQuestions, $answers, (int) $userId );
 
 		if ( $inviteValid && ! $invite->isGroup() ) {
 			$this->invites->markAccepted( (int) $invite->id, (int) $userId );
@@ -228,6 +252,52 @@ class RegistrationPage {
 		return add_query_arg( 'us_confirm', rawurlencode( $rawToken ), $base );
 	}
 
+	/**
+	 * The account-question answers submitted with the form, keyed by question id.
+	 *
+	 * @return array<int, string>
+	 */
+	private function submittedAnswers(): array {
+		// The submit nonce is verified by the caller (render) before this runs.
+		// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- each value is unslashed and sanitized in the loop below.
+		$raw = $_POST['us_answers'] ?? [];
+		if ( ! is_array( $raw ) ) {
+			return [];
+		}
+
+		$out = [];
+		foreach ( $raw as $questionId => $value ) {
+			$out[ absint( Val::int( $questionId ) ) ] = sanitize_textarea_field( Val::string( wp_unslash( $value ) ) );
+		}
+
+		return $out;
+	}
+
+	/**
+	 * Persist the submitted answers for each active account-signup question.
+	 *
+	 * @param list<Question>     $questions
+	 * @param array<int, string> $answers   question_id => submitted value
+	 */
+	private function recordAnswers( array $questions, array $answers, int $userId ): void {
+		foreach ( $questions as $question ) {
+			$value = trim( (string) ( $answers[ (int) $question->id ] ?? '' ) );
+			if ( '' === $value ) {
+				continue;
+			}
+
+			$this->answers->insert(
+				new Answer(
+					questionId:       (int) $question->id,
+					registrationType: Answer::REG_ACCOUNT,
+					registrationId:   $userId,
+					studentId:        $userId,
+					answerValue:      $value,
+				)
+			);
+		}
+	}
+
 	/**
 	 * Record account-time acceptances for each signup policy version.
 	 *