Harden booking, offering exposure, payments, and invites

Security fixes from a pen-test review (issues #31–#37):

- #31 Booking no longer trusts a client-supplied offering_id: a slot-tied
  offering is authoritative and any offering used must belong to the slot's
  instructor, closing a free/misrouted-payment bypass.
- #34 Availability slot creation rejects an offering the instructor does not
  own (AvailabilityEndpoint now takes OfferingRepository).
- #32 Offering/question/policy listing endpoints now require book_lesson
  instead of being public (no anonymous consumer exists); Offering::toArray
  also omits etransfer_email from listings as defense-in-depth.
- #33 Slots are claimed atomically (UPDATE ... WHERE is_booked = 0) before a
  lesson is inserted, preventing a double-booking race.
- #35 A single weekly booking is capped (MAX_WEEKLY_OCCURRENCES) and only
  creates lessons for slots it actually claimed.
- #36 Stripe secret/webhook keys are write-only in the settings UI and a blank
  submit keeps the stored value; secrets are never echoed back into HTML.
- #37 Pending invites expire after 14 days (Invite::isAcceptable), enforced at
  registration and surfaced on the admin invites list.

Adds BookingEndpointTest plus Invite/Offering/AvailabilityRepository coverage
and minimal WP_REST_Request/WP_REST_Response stubs. composer test (200),
lint, and cs all green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

templates/admin/invites.php

@@ -73,10 +73,16 @@ if (! defined('ABSPATH')) {
             </thead>
             <tbody>
                 <?php $linkBase = $registrationPageUrl !== '' ? $registrationPageUrl : home_url('/'); ?>
+                <?php $now = current_time('mysql'); ?>
                 <?php foreach ($pendingInvites as $invite) : ?>
                     <?php $link = esc_url(add_query_arg('us_invite', $invite->token, $linkBase)); ?>
                     <tr>
-                        <td><?php echo esc_html($invite->email); ?></td>
+                        <td>
+                            <?php echo esc_html($invite->email); ?>
+                            <?php if ($invite->isExpired($now)) : ?>
+                                <span class="us-invite-expired" style="color:#b32d2e;">— <?php esc_html_e('expired', 'unsupervised-schedular'); ?></span>
+                            <?php endif; ?>
+                        </td>
                         <td>
                             <input type="text" class="large-text code" readonly value="<?php echo esc_attr($link); ?>" onclick="this.select()">
                         </td>