Add account registration with signup policy acceptance

Implements #16: invite-only student self-registration through a front-end
page, accepting signup-scoped policies at account creation.

Policy domain:
- us_policies.acceptance_scope (signup/booking/both); Policy::appliesTo();
  PolicyRepository::findForScope(); scope threaded through PolicyService,
  the REST create, the admin controller, and the Policies form.
- PolicyAcceptance::REG_ACCOUNT (registration_id = the new user's ID).

Auth:
- Invite value object + InviteRepository; us_invites table.
- RegistrationController + Invites admin page (manage_students): invite an
  email, share the registration link, revoke.
- RegistrationPage ([us_student_register] shortcode): validates the invite
  token, collects name/password, renders signup-scoped published policies
  with required acceptance, creates the us_student user, records account-type
  acceptances, marks the invite accepted, and logs the user in.
- RoleManager: manage_students cap added to STUDIO_ADMIN_CAPS.

Invite-only is implemented; the us_registration_mode self_approval path is a
documented future seam.

Docs: docs/features/account-registration.md; policies.md updated.
Tests: tests/Unit/Auth/ (Invite, InviteRepository) plus Policy scope
updates. composer test (104), cs, and PHPStan level 6 all pass.

Refs #16

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/Policy/Policy.php

@@ -5,10 +5,22 @@ namespace Unsupervised\Schedular\Policy;
 
 class Policy {
 
+	public const SCOPE_SIGNUP  = 'signup';
+	public const SCOPE_BOOKING = 'booking';
+	public const SCOPE_BOTH    = 'both';
+
+	/**
+	 * All valid acceptance scopes — when a policy must be accepted.
+	 *
+	 * @var list<string>
+	 */
+	public const VALID_SCOPES = [ self::SCOPE_SIGNUP, self::SCOPE_BOOKING, self::SCOPE_BOTH ];
+
 	public function __construct(
 		public readonly string $title,
 		public readonly string $slug,
 		public readonly ?int $currentVersionId = null,
+		public readonly string $acceptanceScope = self::SCOPE_BOOKING,
 		public readonly ?int $id = null,
 	) {}
 
@@ -17,10 +29,18 @@ class Policy {
 			title:            $row->title,
 			slug:             $row->slug,
 			currentVersionId: null !== $row->current_version_id ? (int) $row->current_version_id : null,
+			acceptanceScope:  $row->acceptance_scope,
 			id:               (int) $row->id,
 		);
 	}
 
+	/**
+	 * Whether this policy must be accepted in the given gate (`signup` or `booking`).
+	 */
+	public function appliesTo( string $scope ): bool {
+		return $this->acceptanceScope === $scope || self::SCOPE_BOTH === $this->acceptanceScope;
+	}
+
 	/**
 	 * Returns a plain array representation of the policy.
 	 *
@@ -32,6 +52,7 @@ class Policy {
 			'title'              => $this->title,
 			'slug'               => $this->slug,
 			'current_version_id' => $this->currentVersionId,
+			'acceptance_scope'   => $this->acceptanceScope,
 		];
 	}
 }

src/Policy/PolicyAcceptance.php

@@ -5,15 +5,17 @@ namespace Unsupervised\Schedular\Policy;
 
 class PolicyAcceptance {
 
+	public const REG_ACCOUNT    = 'account';
 	public const REG_LESSON     = 'lesson';
 	public const REG_ENROLLMENT = 'enrollment';
 
 	/**
-	 * Polymorphic registration targets an acceptance can attach to.
+	 * Polymorphic registration targets an acceptance can attach to. For `account`
+	 * the registration id is the WordPress user ID.
 	 *
 	 * @var list<string>
 	 */
-	public const VALID_REGISTRATION_TYPES = [ self::REG_LESSON, self::REG_ENROLLMENT ];
+	public const VALID_REGISTRATION_TYPES = [ self::REG_ACCOUNT, self::REG_LESSON, self::REG_ENROLLMENT ];
 
 	public function __construct(
 		public readonly int $policyVersionId,

src/Policy/PolicyController.php

@@ -40,9 +40,14 @@ class PolicyController {
 			$title   = sanitize_text_field( wp_unslash( $_POST['title'] ?? '' ) );
 			$slugRaw = sanitize_text_field( wp_unslash( $_POST['slug'] ?? '' ) );
 			$slug    = sanitize_title( '' !== $slugRaw ? $slugRaw : $title );
+			$scope   = sanitize_key( wp_unslash( $_POST['acceptance_scope'] ?? Policy::SCOPE_BOOKING ) );
+
+			if ( ! in_array( $scope, Policy::VALID_SCOPES, true ) ) {
+				$scope = Policy::SCOPE_BOOKING;
+			}
 
 			if ( '' !== $title && '' !== $slug && null === $this->policies->findBySlug( $slug ) ) {
-				$this->service->createPolicy( $title, $slug );
+				$this->service->createPolicy( $title, $slug, $scope );
 			}
 
 			return;

src/Policy/PolicyEndpoint.php

@@ -113,7 +113,12 @@ class PolicyEndpoint {
 			return new \WP_Error( 'duplicate_slug', __( 'A policy with that slug already exists.', 'unsupervised-schedular' ), [ 'status' => 409 ] );
 		}
 
-		$id = $this->service->createPolicy( $title, $slug );
+		$scope = (string) ( $request->get_param( 'acceptance_scope' ) ?? Policy::SCOPE_BOOKING );
+		if ( ! in_array( $scope, Policy::VALID_SCOPES, true ) ) {
+			return $this->invalid( __( 'Invalid acceptance scope.', 'unsupervised-schedular' ) );
+		}
+
+		$id = $this->service->createPolicy( $title, $slug, $scope );
 
 		return new \WP_REST_Response( [ 'id' => $id ], 201 );
 	}

src/Policy/PolicyRepository.php

@@ -18,14 +18,33 @@ class PolicyRepository {
 				'title'              => $policy->title,
 				'slug'               => $policy->slug,
 				'current_version_id' => $policy->currentVersionId,
+				'acceptance_scope'   => $policy->acceptanceScope,
 				'created_at'         => current_time( 'mysql' ),
 			],
-			[ '%s', '%s', '%d', '%s' ]
+			[ '%s', '%s', '%d', '%s', '%s' ]
 		);
 
 		return $this->db->insert_id;
 	}
 
+	/**
+	 * Policies that must be accepted in the given gate — those scoped to it or to
+	 * `both`. Pass `Policy::SCOPE_SIGNUP` or `Policy::SCOPE_BOOKING`.
+	 *
+	 * @return list<Policy>
+	 */
+	public function findForScope( string $scope ): array {
+		$rows = $this->db->get_results(
+			$this->db->prepare(
+				"SELECT * FROM {$this->table} WHERE acceptance_scope = %s OR acceptance_scope = %s ORDER BY title ASC",
+				$scope,
+				Policy::SCOPE_BOTH
+			)
+		);
+
+		return array_map( Policy::fromRow( ... ), $rows ?? [] );
+	}
+
 	public function updateCurrentVersion( int $policyId, int $versionId ): bool {
 		return false !== $this->db->update(
 			$this->table,

src/Policy/PolicyService.php

@@ -13,8 +13,8 @@ class PolicyService {
 		private PolicyVersionRepository $versions,
 	) {}
 
-	public function createPolicy( string $title, string $slug ): int {
-		return $this->policies->insert( new Policy( $title, $slug ) );
+	public function createPolicy( string $title, string $slug, string $scope = Policy::SCOPE_BOOKING ): int {
+		return $this->policies->insert( new Policy( $title, $slug, acceptanceScope: $scope ) );
 	}
 
 	/**