Let parents register once and book for their children

A parent registers once and manages lessons for one or more children, who
need no login of their own. A child is a real wp_users row with the student
role but no usable login — so student_id keeps meaning "a WordPress user"
on every table, and booking, credits, policies and enrolments work unchanged.
A us_guardians link table maps guardian to child.

The signup form gains a parent/guardian tick that reveals a block per child,
with the account-signup questions asked per child rather than per guardian
— they describe the student, not the account holder. Signup policies are
recorded once per child with the guardian as the acceptor, which is the
record that actually means something. A family that half-creates is rolled
back entirely rather than leaving a guardian who cannot re-register.

The booking and enrolment forms gain a "Who is this for?" picker listing
children first, so the default selection is never the parent — booking for
the wrong child is correctable, quietly billing a parent for their kid's
lesson is not. POST /bookings and POST /enrollments take an optional
student_id honoured only for that child's guardian; anything else is a 403.
That check is the authorisation boundary of the feature.

Payments and credits gain a payer: the charge names the child it was for and
the guardian who owes it, so per-child reporting is unchanged while notices,
receipts and the payment step reach the parent. Credit is held by the payer,
so one child's cancellation can settle a sibling's charge, and the daily
billing scan sends a guardian one notice covering every child.

Closes #132

Co-Authored-By: Claude Opus 5 <[email protected]>

templates/admin/students.php

@@ -6,9 +6,39 @@ if (! defined('ABSPATH')) {
 }
 
 /**
- * @var list<array{id: int, name: string, email: string, registered: string, upcoming: int, enrolments: int}> $students
+ * @var list<array{id: int, name: string, email: string, registered: string, upcoming: int, enrolments: int, guardian: array{id: int, name: string, email: string}|null, children: list<array{id: int, name: string, date_of_birth: string, relationship: string}>}> $students
  * @var string $pageSlug
  */
+
+/**
+ * The Family cell: for a child, the guardian who books for them; for a guardian,
+ * the children they book for. Both link to the other person's detail screen so
+ * an admin can move between a family without going back to the list.
+ */
+$familyCell = static function (array $student) use ($pageSlug): string {
+    $link = static fn(int $id, string $name): string => sprintf(
+        '<a href="%s">%s</a>',
+        esc_url(add_query_arg(['page' => $pageSlug, 'student_id' => $id], admin_url('admin.php'))),
+        esc_html($name)
+    );
+
+    if ($student['guardian'] !== null) {
+        return sprintf(
+            /* translators: %s: linked name of the parent/guardian who books for this student. */
+            esc_html__('Child of %s', 'unsupervised-schedular'),
+            $link($student['guardian']['id'], $student['guardian']['name'])
+        );
+    }
+
+    if ($student['children'] === []) {
+        return '—';
+    }
+
+    return implode(', ', array_map(
+        static fn(array $child): string => $link($child['id'], $child['name']),
+        $student['children']
+    ));
+};
 ?>
 <div class="wrap">
     <h1><?php esc_html_e('Students', 'unsupervised-schedular'); ?></h1>
@@ -21,6 +51,7 @@ if (! defined('ABSPATH')) {
                 <tr>
                     <th><?php esc_html_e('Name', 'unsupervised-schedular'); ?></th>
                     <th><?php esc_html_e('Email', 'unsupervised-schedular'); ?></th>
+                    <th><?php esc_html_e('Family', 'unsupervised-schedular'); ?></th>
                     <th><?php esc_html_e('Registered', 'unsupervised-schedular'); ?></th>
                     <th><?php esc_html_e('Upcoming lessons', 'unsupervised-schedular'); ?></th>
                     <th><?php esc_html_e('Active enrolments', 'unsupervised-schedular'); ?></th>
@@ -32,6 +63,12 @@ if (! defined('ABSPATH')) {
                     <tr>
                         <td><a href="<?php echo esc_url($detailUrl); ?>"><?php echo esc_html($student['name']); ?></a></td>
                         <td><?php echo esc_html($student['email']); ?></td>
+                        <td>
+                            <?php
+                            // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $familyCell escapes every name and URL it interpolates.
+                            echo $familyCell($student);
+                            ?>
+                        </td>
                         <td><?php echo esc_html($student['registered']); ?></td>
                         <td><?php echo esc_html((string) $student['upcoming']); ?></td>
                         <td><?php echo esc_html((string) $student['enrolments']); ?></td>