Let students cancel their own lessons from the booking page

Adds POST /bookings/{id}/cancel (owner-only, idempotent): marks the lesson
cancelled, releases the availability slot for rebooking, and voids a
still-pending payment so it leaves the admin confirmation queue. Paid
payments are untouched — refunds stay a manual admin decision.

The instructor PATCH /bookings/{id}/status path now does the same slot
release and payment voiding on cancellation (previously cancelled lessons
left their slot permanently booked), and reinstating a cancelled lesson
re-claims the slot, rejecting with 409 if the freed time was rebooked.

The "Your upcoming lessons" panel gets a Cancel button with a confirm
prompt; on success both the lesson list and the slot calendar refresh.

Co-Authored-By: Claude Fable 5 <[email protected]>

src/Payment/PaymentService.php

@@ -89,6 +89,22 @@ class PaymentService {
 		return true;
 	}
 
+	/**
+	 * Void the still-pending payment of a cancelled registration so it drops
+	 * out of the confirmation queue. Paid payments are left alone — refunds
+	 * are a manual, admin-side decision.
+	 */
+	public function voidPending( ?int $paymentId ): void {
+		if ( null === $paymentId ) {
+			return;
+		}
+
+		$payment = $this->payments->findById( $paymentId );
+		if ( null !== $payment && Payment::STATUS_PENDING === $payment->status ) {
+			$this->payments->updateStatus( $paymentId, Payment::STATUS_FAILED );
+		}
+	}
+
 	/**
 	 * Resolve the client-side payment step for a freshly created registration.
 	 * For a card payment a Stripe PaymentIntent is created (or replayed