Add invite-only group classes

Group classes can now be marked invite-only (us_offerings.access_mode).
Invite-only classes are hidden from the public catalog and reachable only
when the instructor lets someone in via one of three paths, managed from
My Lessons -> My Group Classes:

- Add students directly: enrols them now with a pending payment.
- Make available: grants registered students access to self-enrol through
  the normal paid flow (multi-select, emailed a notice).
- Invite by email: tokenised registration invite tied to the class for a
  non-account address; after they register the class becomes enrollable.
  Reuses an existing pending invite instead of sending a second link.

New us_group_access table records grants; GET /offerings merges granted
invite-only classes for the caller; enrolment requires a grant
(403 invite_required) and flips it to enrolled on success.

composer test (487), composer lint, composer cs all pass.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

tests/Unit/Auth/InviteTest.php

@@ -155,8 +155,42 @@ class InviteTest extends TestCase
     {
         $arr = (new Invite('[email protected]', 'tok', id: 1))->toArray();
 
-        foreach (['id', 'email', 'token', 'role', 'kind', 'status', 'invited_by', 'accepted_user_id', 'accepted_at', 'expires_at'] as $key) {
+        foreach (['id', 'email', 'token', 'role', 'kind', 'status', 'invited_by', 'accepted_user_id', 'accepted_at', 'expires_at', 'offering_id'] as $key) {
             self::assertArrayHasKey($key, $arr);
         }
     }
+
+    public function testOfferingIdRoundTrips(): void
+    {
+        $invite = Invite::fromRow((object) [
+            'id'               => '5',
+            'email'            => '[email protected]',
+            'token'            => 'tok123',
+            'role'             => RoleManager::STUDENT,
+            'status'           => Invite::STATUS_PENDING,
+            'invited_by'       => '2',
+            'accepted_user_id' => null,
+            'accepted_at'      => null,
+            'offering_id'      => '8',
+        ]);
+
+        self::assertSame(8, $invite->offeringId);
+        self::assertSame(8, $invite->toArray()['offering_id']);
+    }
+
+    public function testOfferingIdDefaultsToNullWhenColumnMissing(): void
+    {
+        $invite = Invite::fromRow((object) [
+            'id'               => '5',
+            'email'            => '[email protected]',
+            'token'            => 'tok123',
+            'role'             => RoleManager::STUDENT,
+            'status'           => Invite::STATUS_PENDING,
+            'invited_by'       => null,
+            'accepted_user_id' => null,
+            'accepted_at'      => null,
+        ]);
+
+        self::assertNull($invite->offeringId);
+    }
 }