Add Instructors admin page (create + per-capability access)

Completes the instructor-management half of #9: the studio admin can now
create instructor accounts and toggle each instructor's capabilities.

- InstructorController (manage_instructors): list instructors, create a
  us_instructor WP user (emailing a set-password link), and a per-instructor
  capability detail view.
- InstructorCapabilities: pure, unit-tested rules for which managed caps an
  admin may assign and how a submitted form maps to assignments. Managed caps
  are manage_offerings, manage_questions, view_own_payments, export_payments;
  manage_availability and view_own_lessons are core to every instructor.
- A studio admin can never grant a capability it does not itself hold: only
  held caps (checked via current_user_can, so an administrator's dynamic grant
  counts) are offered, and on creation any managed cap the admin lacks is
  denied on the new instructor so they never exceed their creator. The role
  grants the managed caps by default; the page layers per-user overrides.
- AdminMenu: register the Instructors page in the people section.
- Tests for the capability logic; docs/features/user-roles.md updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/features/user-roles.md

@@ -68,10 +68,21 @@ Logs in via the front-end `[us_student_login]` shortcode. Can:
 
 ## Instructor Management
 The studio admin gets an **Instructors** admin page (gated by `manage_instructors`)
-to add an instructor — creating the WP user with the `us_instructor` role — and to
-toggle that instructor's per-capability access (e.g. whether they may manage their
-own offerings/questions or export payments). The studio admin cannot grant a
-capability it does not itself hold.
+to add an instructor — creating the WP user with the `us_instructor` role and
+emailing them a set-password link — and to toggle that instructor's per-capability
+access. The managed capabilities are `manage_offerings`, `manage_questions`,
+`view_own_payments`, and `export_payments`; `manage_availability` and
+`view_own_lessons` are core to every instructor and are not managed here. The
+`us_instructor` role grants the managed capabilities by default, and the page
+stores per-user overrides on top of the role.
+
+A studio admin cannot grant a capability it does not itself hold: only
+capabilities the acting user has (checked via `current_user_can()`, so an
+administrator's dynamic grant counts) are offered as toggles, and on creation any
+managed capability the admin lacks is denied on the new instructor so they never
+exceed the creator. The grantable/assignment rules live in the pure, unit-tested
+`Auth\InstructorCapabilities`; `InstructorController` applies the result to the
+`WP_User`.
 
 ## Implementation
 - Class: `Unsupervised\Schedular\Auth\RoleManager`
@@ -81,4 +92,4 @@ capability it does not itself hold.
 
 ## Tests
 - `tests/Unit/Auth/RoleManagerTest.php`
-- `tests/Unit/Auth/InstructorControllerTest.php`
+- `tests/Unit/Auth/InstructorCapabilitiesTest.php`