Add open student registration with email confirmation and approval

Students could previously join by invite only. Add an optional
self-approval mode, toggled from Studio Settings → Registration: anyone
may sign up on the existing [us_student_register] page, confirm their
email via a tokenised link, and then be approved by a studio admin
before the account is usable.

- Enabling the toggle mirrors WordPress's own membership settings
  (users_can_register + default_role = us_student) and snapshots their
  previous values so disabling restores them.
- WordPress's native registration form is blocked while open
  registration is on (login_init redirect + registration_errors
  fail-safe + register_url) so it cannot bypass signup policy acceptance.
- Pending accounts: unconfirmed email cannot log in; confirmed but
  unapproved can log in but the booking capability is withheld and the
  booking page shows an "awaiting approval" screen.
- Approve/reject from Students → Pending Students; reject hard-deletes
  the account so the email is freed to re-apply.
- Invite registration is unchanged; both modes coexist.

Account lifecycle lives in user meta (RegistrationStatus); no new tables.

Closes #63

Co-Authored-By: Claude Opus 4.8 <[email protected]>

tests/Unit/Auth/RegistrationApprovalControllerTest.php

@@ -0,0 +1,96 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Tests\Unit\Auth;
+
+use Brain\Monkey\Functions;
+use Mockery;
+use Unsupervised\Schedular\Auth\RegistrationApprovalController;
+use Unsupervised\Schedular\Auth\RegistrationMailer;
+use Unsupervised\Schedular\Auth\RegistrationStatus;
+use Unsupervised\Schedular\Tests\Unit\TestCase;
+
+class RegistrationApprovalControllerTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Functions\when('wp_unslash')->alias(static fn ($v) => $v);
+        Functions\when('sanitize_key')->alias(static fn ($v) => $v);
+        Functions\when('absint')->alias(static fn ($v) => (int) $v);
+        $_POST = [];
+    }
+
+    protected function tearDown(): void
+    {
+        $_POST = [];
+        parent::tearDown();
+    }
+
+    public function testRenderPageDiesWithoutCapability(): void
+    {
+        Functions\when('current_user_can')->justReturn(false);
+        Functions\when('wp_die')->alias(static function (): void {
+            throw new \RuntimeException('wp_die');
+        });
+
+        $this->expectException(\RuntimeException::class);
+
+        (new RegistrationApprovalController(Mockery::mock(RegistrationMailer::class)))->renderPage();
+    }
+
+    public function testApproveClearsPendingMetaAndEmailsStudent(): void
+    {
+        $_POST = [ 'usc_action' => 'approve', 'user_id' => 7 ];
+
+        Functions\when('get_user_meta')->justReturn('1'); // awaiting approval
+        Functions\expect('delete_user_meta')->atLeast()->once();
+
+        $user = Mockery::mock(\WP_User::class);
+        Functions\when('get_user_by')->justReturn($user);
+
+        $mailer = Mockery::mock(RegistrationMailer::class);
+        $mailer->shouldReceive('sendApproved')->once()->with($user);
+
+        $this->handleAction(new RegistrationApprovalController($mailer));
+    }
+
+    public function testRejectEmailsAndHardDeletesTheAccount(): void
+    {
+        $_POST = [ 'usc_action' => 'reject', 'user_id' => 7 ];
+
+        Functions\when('get_user_meta')->justReturn('1'); // awaiting approval
+
+        $user             = Mockery::mock(\WP_User::class);
+        $user->user_email = '[email protected]';
+        Functions\when('get_user_by')->justReturn($user);
+
+        $mailer = Mockery::mock(RegistrationMailer::class);
+        $mailer->shouldReceive('sendRejected')->once()->with('[email protected]');
+
+        Functions\expect('wp_delete_user')->once()->with(7);
+
+        $this->handleAction(new RegistrationApprovalController($mailer));
+    }
+
+    public function testIgnoresUserNotAwaitingApproval(): void
+    {
+        $_POST = [ 'usc_action' => 'approve', 'user_id' => 7 ];
+
+        Functions\when('get_user_meta')->justReturn(''); // not pending
+
+        $mailer = Mockery::mock(RegistrationMailer::class);
+        $mailer->shouldReceive('sendApproved')->never();
+
+        $this->handleAction(new RegistrationApprovalController($mailer));
+
+        // isAwaitingApproval guarded the action; nothing happened.
+        self::assertFalse(RegistrationStatus::isAwaitingApproval(7));
+    }
+
+    private function handleAction(RegistrationApprovalController $controller): void
+    {
+        $method = new \ReflectionMethod(RegistrationApprovalController::class, 'handleAction');
+        $method->invoke($controller);
+    }
+}