Add account registration with signup policy acceptance

Implements #16: invite-only student self-registration through a front-end
page, accepting signup-scoped policies at account creation.

Policy domain:
- us_policies.acceptance_scope (signup/booking/both); Policy::appliesTo();
  PolicyRepository::findForScope(); scope threaded through PolicyService,
  the REST create, the admin controller, and the Policies form.
- PolicyAcceptance::REG_ACCOUNT (registration_id = the new user's ID).

Auth:
- Invite value object + InviteRepository; us_invites table.
- RegistrationController + Invites admin page (manage_students): invite an
  email, share the registration link, revoke.
- RegistrationPage ([us_student_register] shortcode): validates the invite
  token, collects name/password, renders signup-scoped published policies
  with required acceptance, creates the us_student user, records account-type
  acceptances, marks the invite accepted, and logs the user in.
- RoleManager: manage_students cap added to STUDIO_ADMIN_CAPS.

Invite-only is implemented; the us_registration_mode self_approval path is a
documented future seam.

Docs: docs/features/account-registration.md; policies.md updated.
Tests: tests/Unit/Auth/ (Invite, InviteRepository) plus Policy scope
updates. composer test (104), cs, and PHPStan level 6 all pass.

Refs #16

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/Auth/RegistrationController.php

@@ -0,0 +1,55 @@
+<?php
+declare(strict_types=1);
+
+namespace Unsupervised\Schedular\Auth;
+
+class RegistrationController {
+
+	public function __construct( private InviteRepository $invites ) {}
+
+	public function renderPage(): void {
+		if ( ! current_user_can( RoleManager::CAP_MANAGE_STUDENTS ) ) {
+			wp_die( esc_html__( 'You do not have permission to manage invites.', 'unsupervised-schedular' ) );
+		}
+
+		if ( isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_invite_action' ) ) {
+			$this->handleFormAction();
+		}
+
+		$pendingInvites = $this->invites->findPending();
+
+		include USC_PLUGIN_DIR . 'templates/admin/invites.php';
+	}
+
+	private function handleFormAction(): void {
+		// Nonce is verified by the caller (renderPage) before this method runs.
+		// phpcs:disable WordPress.Security.NonceVerification.Missing
+		$action = sanitize_key( wp_unslash( $_POST['usc_action'] ?? '' ) );
+
+		if ( 'invite' === $action ) {
+			$email = sanitize_email( wp_unslash( $_POST['email'] ?? '' ) );
+
+			if (
+				is_email( $email )
+				&& false === email_exists( $email )
+				&& null === $this->invites->findPendingByEmail( $email )
+			) {
+				$this->invites->insert(
+					new Invite(
+						email:     $email,
+						token:     wp_generate_password( 32, false ),
+						invitedBy: get_current_user_id(),
+					)
+				);
+			}
+		}
+
+		if ( 'revoke' === $action ) {
+			$inviteId = absint( $_POST['invite_id'] ?? 0 );
+			if ( $inviteId > 0 ) {
+				$this->invites->revoke( $inviteId );
+			}
+		}
+		// phpcs:enable WordPress.Security.NonceVerification.Missing
+	}
+}