Add invite-only group classes

Group classes can now be marked invite-only (us_offerings.access_mode).
Invite-only classes are hidden from the public catalog and reachable only
when the instructor lets someone in via one of three paths, managed from
My Lessons -> My Group Classes:

- Add students directly: enrols them now with a pending payment.
- Make available: grants registered students access to self-enrol through
  the normal paid flow (multi-select, emailed a notice).
- Invite by email: tokenised registration invite tied to the class for a
  non-account address; after they register the class becomes enrollable.
  Reuses an existing pending invite instead of sending a second link.

New us_group_access table records grants; GET /offerings merges granted
invite-only classes for the caller; enrolment requires a grant
(403 invite_required) and flips it to enrolled on success.

composer test (487), composer lint, composer cs all pass.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

tests/Unit/Offering/OfferingRepositoryTest.php

@@ -154,6 +154,44 @@ class OfferingRepositoryTest extends TestCase
         $this->repo->findAll(3, Offering::KIND_GROUP_CLASS);
     }
 
+    public function testFindAllFiltersByAccessMode(): void
+    {
+        $this->db->shouldReceive('prepare')
+            ->once()
+            ->with(
+                Mockery::pattern('/access_mode = %s/'),
+                Mockery::on(static fn (array $p): bool => $p === ['wp_us_offerings', Offering::ACCESS_PUBLIC])
+            )
+            ->andReturn('SELECT ...');
+
+        $this->db->shouldReceive('get_results')->andReturn([]);
+
+        self::assertSame([], $this->repo->findAll(accessMode: Offering::ACCESS_PUBLIC));
+    }
+
+    public function testInsertPersistsAccessMode(): void
+    {
+        Functions\expect('current_time')->with('mysql')->andReturn('2026-04-01 12:00:00');
+
+        $this->db->shouldReceive('insert')
+            ->once()
+            ->with(
+                'wp_us_offerings',
+                Mockery::on(static fn (array $data): bool => $data['access_mode'] === Offering::ACCESS_INVITE_ONLY),
+                Mockery::type('array')
+            );
+        $this->db->insert_id = 1;
+
+        $offering = new Offering(
+            instructorId: 5,
+            kind:         Offering::KIND_GROUP_CLASS,
+            title:        'Private Choir',
+            accessMode:   Offering::ACCESS_INVITE_ONLY,
+        );
+
+        self::assertSame(1, $this->repo->insert($offering));
+    }
+
     public function testDeleteCallsWpdbDelete(): void
     {
         $this->db->shouldReceive('delete')