Add account registration with signup policy acceptance

Implements #16: invite-only student self-registration through a front-end
page, accepting signup-scoped policies at account creation.

Policy domain:
- us_policies.acceptance_scope (signup/booking/both); Policy::appliesTo();
  PolicyRepository::findForScope(); scope threaded through PolicyService,
  the REST create, the admin controller, and the Policies form.
- PolicyAcceptance::REG_ACCOUNT (registration_id = the new user's ID).

Auth:
- Invite value object + InviteRepository; us_invites table.
- RegistrationController + Invites admin page (manage_students): invite an
  email, share the registration link, revoke.
- RegistrationPage ([us_student_register] shortcode): validates the invite
  token, collects name/password, renders signup-scoped published policies
  with required acceptance, creates the us_student user, records account-type
  acceptances, marks the invite accepted, and logs the user in.
- RoleManager: manage_students cap added to STUDIO_ADMIN_CAPS.

Invite-only is implemented; the us_registration_mode self_approval path is a
documented future seam.

Docs: docs/features/account-registration.md; policies.md updated.
Tests: tests/Unit/Auth/ (Invite, InviteRepository) plus Policy scope
updates. composer test (104), cs, and PHPStan level 6 all pass.

Refs #16

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/Unit/Policy/PolicyRepositoryTest.php

@@ -31,14 +31,35 @@ class PolicyRepositoryTest extends TestCase
             ->once()
             ->with(
                 'wp_us_policies',
-                Mockery::on(static fn (array $d): bool => $d['title'] === 'Cancellation' && $d['slug'] === 'cancellation' && $d['current_version_id'] === null),
-                ['%s', '%s', '%d', '%s']
+                Mockery::on(static fn (array $d): bool => $d['title'] === 'Cancellation' && $d['slug'] === 'cancellation' && $d['current_version_id'] === null && $d['acceptance_scope'] === Policy::SCOPE_BOOKING),
+                ['%s', '%s', '%d', '%s', '%s']
             );
         $this->db->insert_id = 7;
 
         self::assertSame(7, $this->repo->insert(new Policy('Cancellation', 'cancellation')));
     }
 
+    public function testFindForScopeMatchesScopeOrBoth(): void
+    {
+        $this->db->shouldReceive('prepare')
+            ->once()
+            ->with(
+                Mockery::pattern('/acceptance_scope = %s OR acceptance_scope = %s/'),
+                Policy::SCOPE_SIGNUP,
+                Policy::SCOPE_BOTH
+            )
+            ->andReturn('SELECT ...');
+
+        $this->db->shouldReceive('get_results')->andReturn([
+            (object) ['id' => '1', 'title' => 'Terms', 'slug' => 'terms', 'current_version_id' => '5', 'acceptance_scope' => Policy::SCOPE_SIGNUP],
+        ]);
+
+        $found = $this->repo->findForScope(Policy::SCOPE_SIGNUP);
+
+        self::assertCount(1, $found);
+        self::assertSame(Policy::SCOPE_SIGNUP, $found[0]->acceptanceScope);
+    }
+
     public function testUpdateCurrentVersion(): void
     {
         $this->db->shouldReceive('update')
@@ -57,6 +78,7 @@ class PolicyRepositoryTest extends TestCase
             'title'              => 'Cancellation',
             'slug'               => 'cancellation',
             'current_version_id' => null,
+            'acceptance_scope'   => Policy::SCOPE_BOOKING,
         ]);
 
         $policy = $this->repo->findBySlug('cancellation');
@@ -76,7 +98,7 @@ class PolicyRepositoryTest extends TestCase
     public function testFindAllMapsRows(): void
     {
         $this->db->shouldReceive('get_results')->andReturn([
-            (object) ['id' => '1', 'title' => 'A', 'slug' => 'a', 'current_version_id' => null],
+            (object) ['id' => '1', 'title' => 'A', 'slug' => 'a', 'current_version_id' => null, 'acceptance_scope' => Policy::SCOPE_BOOKING],
         ]);
 
         $all = $this->repo->findAll();