Harden booking, offering exposure, payments, and invites

Security fixes from a pen-test review (issues #31–#37):

- #31 Booking no longer trusts a client-supplied offering_id: a slot-tied
  offering is authoritative and any offering used must belong to the slot's
  instructor, closing a free/misrouted-payment bypass.
- #34 Availability slot creation rejects an offering the instructor does not
  own (AvailabilityEndpoint now takes OfferingRepository).
- #32 Offering/question/policy listing endpoints now require book_lesson
  instead of being public (no anonymous consumer exists); Offering::toArray
  also omits etransfer_email from listings as defense-in-depth.
- #33 Slots are claimed atomically (UPDATE ... WHERE is_booked = 0) before a
  lesson is inserted, preventing a double-booking race.
- #35 A single weekly booking is capped (MAX_WEEKLY_OCCURRENCES) and only
  creates lessons for slots it actually claimed.
- #36 Stripe secret/webhook keys are write-only in the settings UI and a blank
  submit keeps the stored value; secrets are never echoed back into HTML.
- #37 Pending invites expire after 14 days (Invite::isAcceptable), enforced at
  registration and surfaced on the admin invites list.

Adds BookingEndpointTest plus Invite/Offering/AvailabilityRepository coverage
and minimal WP_REST_Request/WP_REST_Response stubs. composer test (200),
lint, and cs all green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/Unit/Auth/InviteTest.php

@@ -60,6 +60,41 @@ class InviteTest extends TestCase
         self::assertTrue($invite->isPending());
     }
 
+    public function testIsExpiredWhenOlderThanExpiryWindow(): void
+    {
+        $created = gmdate('Y-m-d H:i:s', strtotime('2026-06-01 09:00:00'));
+        $now     = '2026-06-20 09:00:00'; // 19 days later, beyond the 14-day window.
+
+        $invite = new Invite('a@b.test', 'tok', createdAt: $created);
+
+        self::assertTrue($invite->isExpired($now));
+        self::assertFalse($invite->isAcceptable($now));
+    }
+
+    public function testIsNotExpiredWithinExpiryWindow(): void
+    {
+        $invite = new Invite('a@b.test', 'tok', createdAt: '2026-06-01 09:00:00');
+        $now    = '2026-06-10 09:00:00'; // 9 days later, inside the window.
+
+        self::assertFalse($invite->isExpired($now));
+        self::assertTrue($invite->isAcceptable($now));
+    }
+
+    public function testIsNotExpiredWhenCreatedAtUnknown(): void
+    {
+        $invite = new Invite('a@b.test', 'tok');
+
+        self::assertFalse($invite->isExpired('2030-01-01 00:00:00'));
+        self::assertTrue($invite->isAcceptable('2030-01-01 00:00:00'));
+    }
+
+    public function testAcceptedInviteIsNotAcceptableEvenWhenFresh(): void
+    {
+        $invite = new Invite('a@b.test', 'tok', status: Invite::STATUS_ACCEPTED, createdAt: '2026-06-01 09:00:00');
+
+        self::assertFalse($invite->isAcceptable('2026-06-02 09:00:00'));
+    }
+
     public function testToArrayContainsExpectedKeys(): void
     {
         $arr = (new Invite('a@b.test', 'tok', id: 1))->toArray();