Add account registration with signup policy acceptance

Implements #16: invite-only student self-registration through a front-end
page, accepting signup-scoped policies at account creation.

Policy domain:
- us_policies.acceptance_scope (signup/booking/both); Policy::appliesTo();
  PolicyRepository::findForScope(); scope threaded through PolicyService,
  the REST create, the admin controller, and the Policies form.
- PolicyAcceptance::REG_ACCOUNT (registration_id = the new user's ID).

Auth:
- Invite value object + InviteRepository; us_invites table.
- RegistrationController + Invites admin page (manage_students): invite an
  email, share the registration link, revoke.
- RegistrationPage ([us_student_register] shortcode): validates the invite
  token, collects name/password, renders signup-scoped published policies
  with required acceptance, creates the us_student user, records account-type
  acceptances, marks the invite accepted, and logs the user in.
- RoleManager: manage_students cap added to STUDIO_ADMIN_CAPS.

Invite-only is implemented; the us_registration_mode self_approval path is a
documented future seam.

Docs: docs/features/account-registration.md; policies.md updated.
Tests: tests/Unit/Auth/ (Invite, InviteRepository) plus Policy scope
updates. composer test (104), cs, and PHPStan level 6 all pass.

Refs #16

Co-Authored-By: Claude Opus 4.8 <[email protected]>

src/Auth/InviteRepository.php

@@ -0,0 +1,103 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Auth;
+
+class InviteRepository {
+
+	private string $table;
+
+	public function __construct( private \wpdb $db ) {
+		$this->table = $db->prefix . 'us_invites';
+	}
+
+	public function insert( Invite $invite ): int {
+		$this->db->insert(
+			$this->table,
+			[
+				'email'            => $invite->email,
+				'token'            => $invite->token,
+				'role'             => $invite->role,
+				'status'           => $invite->status,
+				'invited_by'       => $invite->invitedBy,
+				'accepted_user_id' => $invite->acceptedUserId,
+				'created_at'       => current_time( 'mysql' ),
+				'accepted_at'      => $invite->acceptedAt,
+			],
+			[ '%s', '%s', '%s', '%s', '%d', '%d', '%s', '%s' ]
+		);
+
+		return $this->db->insert_id;
+	}
+
+	public function findByToken( string $token ): ?Invite {
+		$row = $this->db->get_row(
+			$this->db->prepare( "SELECT * FROM {$this->table} WHERE token = %s", $token )
+		);
+
+		return $row ? Invite::fromRow( $row ) : null;
+	}
+
+	public function findById( int $id ): ?Invite {
+		$row = $this->db->get_row(
+			$this->db->prepare( "SELECT * FROM {$this->table} WHERE id = %d", $id )
+		);
+
+		return $row ? Invite::fromRow( $row ) : null;
+	}
+
+	/**
+	 * The most recent pending invite for an email, if any.
+	 */
+	public function findPendingByEmail( string $email ): ?Invite {
+		$row = $this->db->get_row(
+			$this->db->prepare(
+				"SELECT * FROM {$this->table} WHERE email = %s AND status = %s ORDER BY id DESC LIMIT 1",
+				$email,
+				Invite::STATUS_PENDING
+			)
+		);
+
+		return $row ? Invite::fromRow( $row ) : null;
+	}
+
+	/**
+	 * All invites awaiting acceptance, newest first.
+	 *
+	 * @return list<Invite>
+	 */
+	public function findPending(): array {
+		$rows = $this->db->get_results(
+			$this->db->prepare(
+				"SELECT * FROM {$this->table} WHERE status = %s ORDER BY created_at DESC",
+				Invite::STATUS_PENDING
+			)
+		);
+
+		return array_map( Invite::fromRow( ... ), $rows ?? [] );
+	}
+
+	public function markAccepted( int $id, int $userId ): bool {
+		return false !== $this->db->update(
+			$this->table,
+			[
+				'status'           => Invite::STATUS_ACCEPTED,
+				'accepted_user_id' => $userId,
+				'accepted_at'      => current_time( 'mysql' ),
+			],
+			[ 'id' => $id ],
+			[ '%s', '%d', '%s' ],
+			[ '%d' ]
+		);
+	}
+
+	public function revoke( int $id ): bool {
+		return false !== $this->db->update(
+			$this->table,
+			[ 'status' => Invite::STATUS_REVOKED ],
+			[ 'id' => $id ],
+			[ '%s' ],
+			[ '%d' ]
+		);
+	}
+}