Add admin actions to the student detail view: cancel, withdraw, edit account

Adds the #70 follow-up onto the student detail page: studio admins can now
cancel an upcoming lesson (same path as student cancellation — slot freed,
pending payment voided), withdraw an active group-class enrolment (seat
freed, pending payment voided), and edit the student's display name and
email with validation and uniqueness checks.

Action logic lives in the new Auth\StudentActions (unit-tested with mocked
repositories); the controller routes nonce-protected POSTs to it and shows
success/error notices.

Closes #70

Co-Authored-By: Claude Fable 5 <[email protected]>

src/Auth/StudentActions.php

@@ -0,0 +1,92 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Auth;
+
+use Unsupervised\Schedular\Availability\AvailabilityRepository;
+use Unsupervised\Schedular\Booking\BookingRepository;
+use Unsupervised\Schedular\Booking\Lesson;
+use Unsupervised\Schedular\GroupClass\Enrollment;
+use Unsupervised\Schedular\GroupClass\EnrollmentRepository;
+use Unsupervised\Schedular\Payment\PaymentService;
+
+/**
+ * Studio-admin actions on a single student from the student detail view:
+ * cancelling a lesson, withdrawing a group-class enrolment, and editing basic
+ * account details. Mutations go through the same paths as the student-facing
+ * flows so slot release and pending-payment voiding stay consistent.
+ */
+class StudentActions {
+
+	public function __construct(
+		private BookingRepository $bookings,
+		private AvailabilityRepository $availability,
+		private EnrollmentRepository $enrollments,
+		private PaymentService $payments,
+	) {}
+
+	/**
+	 * Cancel a lesson on the student's behalf: marks it cancelled, frees the
+	 * slot for rebooking, and voids a still-pending payment. Paid lessons keep
+	 * their payment — refunds are a manual, admin-side decision.
+	 */
+	public function cancelLesson( int $lessonId, int $studentId ): bool {
+		$lesson = $this->bookings->findById( $lessonId );
+
+		if ( null === $lesson || $lesson->studentId !== $studentId || Lesson::STATUS_CANCELLED === $lesson->status ) {
+			return false;
+		}
+
+		$this->bookings->updateStatus( $lessonId, Lesson::STATUS_CANCELLED );
+		$this->availability->release( $lesson->slotId );
+		$this->payments->voidPending( $lesson->paymentId );
+
+		return true;
+	}
+
+	/**
+	 * Withdraw the student from a group class: marks the active enrolment
+	 * cancelled (freeing its capacity seat) and voids a still-pending payment.
+	 */
+	public function withdrawEnrollment( int $enrollmentId, int $studentId ): bool {
+		$enrollment = $this->enrollments->findById( $enrollmentId );
+
+		if ( null === $enrollment || $enrollment->studentId !== $studentId || Enrollment::STATUS_ACTIVE !== $enrollment->status ) {
+			return false;
+		}
+
+		$this->enrollments->updateStatus( $enrollmentId, Enrollment::STATUS_CANCELLED );
+		$this->payments->voidPending( $enrollment->paymentId );
+
+		return true;
+	}
+
+	/**
+	 * Update the student's display name and email. The email must be valid and
+	 * not belong to another user.
+	 */
+	public function updateAccount( int $studentId, string $displayName, string $email ): bool|\WP_Error {
+		if ( '' === $displayName ) {
+			return new \WP_Error( 'empty_name', __( 'Display name cannot be empty.', 'unsupervised-schedular' ) );
+		}
+
+		if ( ! is_email( $email ) ) {
+			return new \WP_Error( 'invalid_email', __( 'Please enter a valid email address.', 'unsupervised-schedular' ) );
+		}
+
+		$existing = email_exists( $email );
+		if ( false !== $existing && (int) $existing !== $studentId ) {
+			return new \WP_Error( 'email_taken', __( 'Another account already uses this email address.', 'unsupervised-schedular' ) );
+		}
+
+		$result = wp_update_user(
+			[
+				'ID'           => $studentId,
+				'display_name' => $displayName,
+				'user_email'   => $email,
+			]
+		);
+
+		return $result instanceof \WP_Error ? $result : true;
+	}
+}