Let parents register once and book for their children

A parent registers once and manages lessons for one or more children, who
need no login of their own. A child is a real wp_users row with the student
role but no usable login — so student_id keeps meaning "a WordPress user"
on every table, and booking, credits, policies and enrolments work unchanged.
A us_guardians link table maps guardian to child.

The signup form gains a parent/guardian tick that reveals a block per child,
with the account-signup questions asked per child rather than per guardian
— they describe the student, not the account holder. Signup policies are
recorded once per child with the guardian as the acceptor, which is the
record that actually means something. A family that half-creates is rolled
back entirely rather than leaving a guardian who cannot re-register.

The booking and enrolment forms gain a "Who is this for?" picker listing
children first, so the default selection is never the parent — booking for
the wrong child is correctable, quietly billing a parent for their kid's
lesson is not. POST /bookings and POST /enrollments take an optional
student_id honoured only for that child's guardian; anything else is a 403.
That check is the authorisation boundary of the feature.

Payments and credits gain a payer: the charge names the child it was for and
the guardian who owes it, so per-child reporting is unchanged while notices,
receipts and the payment step reach the parent. Credit is held by the payer,
so one child's cancellation can settle a sibling's charge, and the daily
billing scan sends a guardian one notice covering every child.

Closes #132

Co-Authored-By: Claude Opus 5 <[email protected]>

src/Policy/AcceptanceRepository.php

@@ -17,12 +17,13 @@ class AcceptanceRepository {
 			[
 				'policy_version_id' => $acceptance->policyVersionId,
 				'student_id'        => $acceptance->studentId,
+				'accepted_by'       => $acceptance->acceptorOrStudent(),
 				'registration_type' => $acceptance->registrationType,
 				'registration_id'   => $acceptance->registrationId,
 				'ip_address'        => $acceptance->ipAddress,
 				'accepted_at'       => current_time( 'mysql' ),
 			],
-			[ '%d', '%d', '%s', '%d', '%s', '%s' ]
+			[ '%d', '%d', '%d', '%s', '%d', '%s', '%s' ]
 		);
 
 		return $this->db->insert_id;
@@ -38,6 +39,19 @@ class AcceptanceRepository {
 		return array_map( fn( PolicyAcceptance $a ): int => $this->insert( $a ), $acceptances );
 	}
 
+	/**
+	 * Backfill `accepted_by` on acceptances recorded before guardian accounts
+	 * existed, where the student always agreed for themselves. Run once from the
+	 * installer so the acceptor is a real user id on every row.
+	 */
+	public function backfillAcceptedBy(): void {
+		$sql = $this->db->prepare( 'UPDATE %i SET accepted_by = student_id WHERE accepted_by = 0', $this->table );
+
+		if ( null !== $sql ) {
+			$this->db->query( $sql );
+		}
+	}
+
 	/**
 	 * Find all acceptances attached to a registration (lesson or enrolment).
 	 *

src/Policy/PolicyAcceptance.php

@@ -24,6 +24,13 @@ class PolicyAcceptance {
 		public readonly int $studentId,
 		public readonly string $registrationType,
 		public readonly int $registrationId,
+		/**
+		 * Who actually clicked "I agree" — a child's guardian, or 0 meaning the
+		 * student agreed for themselves. Zero rather than a copy of `studentId`
+		 * so every acceptance recorded before guardian accounts existed keeps its
+		 * original meaning.
+		 */
+		public readonly int $acceptedBy = 0,
 		public readonly ?string $ipAddress = null,
 		public readonly ?string $acceptedAt = null,
 		public readonly ?int $id = null,
@@ -35,12 +42,31 @@ class PolicyAcceptance {
 			studentId:        Val::int( $row->student_id ),
 			registrationType: Val::string( $row->registration_type ),
 			registrationId:   Val::int( $row->registration_id ),
+			acceptedBy:       Val::int( $row->accepted_by ?? 0 ),
 			ipAddress:        Val::stringOrNull( $row->ip_address ),
 			acceptedAt:       Val::stringOrNull( $row->accepted_at ),
 			id:               Val::int( $row->id ),
 		);
 	}
 
+	/**
+	 * Who this acceptance is legally attributable to: the recorded acceptor,
+	 * falling back to the student. Callers go through here so the `0` default of a
+	 * pre-guardian acceptance never leaks out as a user id.
+	 */
+	public function acceptorOrStudent(): int {
+		return $this->acceptedBy > 0 ? $this->acceptedBy : $this->studentId;
+	}
+
+	/**
+	 * Whether someone other than the student agreed — a guardian accepting on a
+	 * child's behalf. Drives the "accepted by" line on the admin screen, which is
+	 * noise when they are the same person.
+	 */
+	public function acceptedOnBehalf(): bool {
+		return $this->acceptedBy > 0 && $this->acceptedBy !== $this->studentId;
+	}
+
 	/**
 	 * Returns a plain array representation of the acceptance.
 	 *
@@ -51,6 +77,7 @@ class PolicyAcceptance {
 			'id'                => $this->id,
 			'policy_version_id' => $this->policyVersionId,
 			'student_id'        => $this->studentId,
+			'accepted_by'       => $this->acceptorOrStudent(),
 			'registration_type' => $this->registrationType,
 			'registration_id'   => $this->registrationId,
 			'ip_address'        => $this->ipAddress,