Require a name and birth year for every student

Both fields are marked in their labels the same way a required registration
question is, and enforced on the server whichever form they arrive from:
GuardianService::createChild() and updateChild() now refuse a blank name or
an unusable birth year, and the signup form checks the same rule up front,
before it creates a single user, so a bad block never leaves a
half-registered family behind. normaliseBirthYear() became public and static
so both paths share one definition of what a usable year is.

The signup form cannot lean on the browser here. Its child blocks are hidden
until the parent/guardian box is ticked, and a `required` field inside a
hidden container makes the whole form unsubmittable with no control the user
can reach to fix — the same trap the guardian's own question panel already
sidesteps by disabling rather than hiding. So register.js puts `required` on
and takes it off along with the block itself, and the server is what makes
the rule hold with JavaScript off. The profile screen has no such problem:
its forms are always visible, so the attribute is static there.

One behaviour change beyond the requirement: a child block with anything
typed into it is now reported back instead of dropped. Previously any block
without a name was silently discarded, which would now mean losing a birth
year the guardian had filled in. A wholly untouched spare block — the one
the form always renders for "add another" — is still ignored.

Verified the required-toggling in a headless browser: unticked submits,
ticked blocks an empty block, a cloned block inherits the requirement, and
re-unticking leaves nothing behind to block a non-guardian signup.

Closes #148

Co-Authored-By: Claude Opus 5 <[email protected]>

assets/js/register.js

@@ -111,6 +111,16 @@
 		function sync() {
 			children.hidden = !toggle.checked;
 
+			// Each student's name and birth year are required, but only once the
+			// block is in play: a `required` field inside a hidden container makes
+			// the form unsubmittable with no way to reach the offending control, so
+			// the attribute goes on and comes off with the block itself. The server
+			// enforces the same rule either way.
+			var required = children.querySelectorAll('[data-us-child-required]');
+			for (var r = 0; r < required.length; r++) {
+				required[r].required = toggle.checked;
+			}
+
 			if (!steps) {
 				return;
 			}
@@ -141,6 +151,10 @@
 				nextIndex += 1;
 
 				children.insertBefore(clone, addButton.parentNode);
+
+				// The clone carries the data attribute but not necessarily the
+				// current required state, so settle it the same way as the rest.
+				sync();
 			});
 		}
 	}