Add invite-only group classes

Group classes can now be marked invite-only (us_offerings.access_mode).
Invite-only classes are hidden from the public catalog and reachable only
when the instructor lets someone in via one of three paths, managed from
My Lessons -> My Group Classes:

- Add students directly: enrols them now with a pending payment.
- Make available: grants registered students access to self-enrol through
  the normal paid flow (multi-select, emailed a notice).
- Invite by email: tokenised registration invite tied to the class for a
  non-account address; after they register the class becomes enrollable.
  Reuses an existing pending invite instead of sending a second link.

New us_group_access table records grants; GET /offerings merges granted
invite-only classes for the caller; enrolment requires a grant
(403 invite_required) and flips it to enrolled on success.

composer test (487), composer lint, composer cs all pass.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

src/Schema.php

@@ -66,6 +66,7 @@ class Schema {
                 schedule_note    VARCHAR(191)    DEFAULT NULL,
                 etransfer_email  VARCHAR(191)    DEFAULT NULL,
                 cancellation_cutoff_hours SMALLINT UNSIGNED DEFAULT NULL,
+                access_mode      VARCHAR(20)     NOT NULL DEFAULT 'public',
                 is_active        TINYINT(1)      NOT NULL DEFAULT 1,
                 created_at       DATETIME        NOT NULL,
                 PRIMARY KEY (id),
@@ -190,6 +191,7 @@ class Schema {
                 token            VARCHAR(64)     NOT NULL,
                 role             VARCHAR(32)     NOT NULL DEFAULT 'us_student',
                 kind             VARCHAR(10)     NOT NULL DEFAULT 'personal',
+                offering_id      BIGINT UNSIGNED DEFAULT NULL,
                 status           VARCHAR(20)     NOT NULL DEFAULT 'pending',
                 invited_by       BIGINT UNSIGNED DEFAULT NULL,
                 accepted_user_id BIGINT UNSIGNED DEFAULT NULL,
@@ -201,6 +203,22 @@ class Schema {
                 KEY email (email),
                 KEY status (status)
             ) {$charset};",
+
+			"CREATE TABLE {$prefix}us_group_access (
+                id            BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
+                offering_id   BIGINT UNSIGNED NOT NULL,
+                student_id    BIGINT UNSIGNED DEFAULT NULL,
+                email         VARCHAR(191)    NOT NULL DEFAULT '',
+                invite_id     BIGINT UNSIGNED DEFAULT NULL,
+                status        VARCHAR(20)     NOT NULL DEFAULT 'invited',
+                invited_by    BIGINT UNSIGNED DEFAULT NULL,
+                created_at    DATETIME        NOT NULL,
+                PRIMARY KEY (id),
+                KEY offering_id (offering_id),
+                KEY student_id (student_id),
+                KEY email (email),
+                KEY status (status)
+            ) {$charset};",
 		];
 	}
 }