Add invite-only group classes

Group classes can now be marked invite-only (us_offerings.access_mode).
Invite-only classes are hidden from the public catalog and reachable only
when the instructor lets someone in via one of three paths, managed from
My Lessons -> My Group Classes:

- Add students directly: enrols them now with a pending payment.
- Make available: grants registered students access to self-enrol through
  the normal paid flow (multi-select, emailed a notice).
- Invite by email: tokenised registration invite tied to the class for a
  non-account address; after they register the class becomes enrollable.
  Reuses an existing pending invite instead of sending a second link.

New us_group_access table records grants; GET /offerings merges granted
invite-only classes for the caller; enrolment requires a grant
(403 invite_required) and flips it to enrolled on success.

composer test (487), composer lint, composer cs all pass.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

src/Auth/Invite.php

@@ -51,6 +51,7 @@ class Invite {
 		public readonly ?string $createdAt = null,
 		public readonly string $kind = self::KIND_PERSONAL,
 		public readonly ?string $expiresAt = null,
+		public readonly ?int $offeringId = null,
 		public readonly ?int $id = null,
 	) {}
 
@@ -66,6 +67,7 @@ class Invite {
 			createdAt:      Val::stringOrNull( $row->created_at ?? null ),
 			kind:           '' !== Val::string( $row->kind ?? '' ) ? Val::string( $row->kind ) : self::KIND_PERSONAL,
 			expiresAt:      Val::stringOrNull( $row->expires_at ?? null ),
+			offeringId:     Val::intOrNull( $row->offering_id ?? null ),
 			id:             Val::int( $row->id ),
 		);
 	}
@@ -132,6 +134,7 @@ class Invite {
 			'accepted_user_id' => $this->acceptedUserId,
 			'accepted_at'      => $this->acceptedAt,
 			'expires_at'       => $this->expiresAt,
+			'offering_id'      => $this->offeringId,
 		];
 	}
 }