Add invite-only group classes

Group classes can now be marked invite-only (us_offerings.access_mode).
Invite-only classes are hidden from the public catalog and reachable only
when the instructor lets someone in via one of three paths, managed from
My Lessons -> My Group Classes:

- Add students directly: enrols them now with a pending payment.
- Make available: grants registered students access to self-enrol through
  the normal paid flow (multi-select, emailed a notice).
- Invite by email: tokenised registration invite tied to the class for a
  non-account address; after they register the class becomes enrollable.
  Reuses an existing pending invite instead of sending a second link.

New us_group_access table records grants; GET /offerings merges granted
invite-only classes for the caller; enrolment requires a grant
(403 invite_required) and flips it to enrolled on success.

composer test (487), composer lint, composer cs all pass.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

tests/Unit/Auth/RegistrationMailerTest.php

@@ -81,4 +81,42 @@ class RegistrationMailerTest extends TestCase
     {
         self::assertFalse((new RegistrationMailer())->sendRejected(''));
     }
+
+    public function testSendClassAccessGrantedEmailsTheStudent(): void
+    {
+        Functions\expect('wp_mail')
+            ->once()
+            ->with(
+                '[email protected]',
+                Mockery::on(static fn (string $subject): bool => str_contains($subject, 'Choir')),
+                Mockery::on(static fn (string $body): bool => str_contains($body, 'Choir'))
+            )
+            ->andReturn(true);
+
+        self::assertTrue((new RegistrationMailer())->sendClassAccessGranted($this->user('[email protected]'), 'Choir'));
+    }
+
+    public function testSendClassAccessGrantedReturnsFalseWithoutRecipient(): void
+    {
+        self::assertFalse((new RegistrationMailer())->sendClassAccessGranted($this->user(''), 'Choir'));
+    }
+
+    public function testSendClassInviteIncludesTheLink(): void
+    {
+        Functions\expect('wp_mail')
+            ->once()
+            ->with(
+                '[email protected]',
+                Mockery::type('string'),
+                Mockery::on(static fn (string $body): bool => str_contains($body, 'http://join.test'))
+            )
+            ->andReturn(true);
+
+        self::assertTrue((new RegistrationMailer())->sendClassInvite('[email protected]', 'http://join.test', 'Choir'));
+    }
+
+    public function testSendClassInviteReturnsFalseWithoutRecipient(): void
+    {
+        self::assertFalse((new RegistrationMailer())->sendClassInvite('', 'http://join.test', 'Choir'));
+    }
 }