Let parents register once and book for their children

A parent registers once and manages lessons for one or more children, who
need no login of their own. A child is a real wp_users row with the student
role but no usable login — so student_id keeps meaning "a WordPress user"
on every table, and booking, credits, policies and enrolments work unchanged.
A us_guardians link table maps guardian to child.

The signup form gains a parent/guardian tick that reveals a block per child,
with the account-signup questions asked per child rather than per guardian
— they describe the student, not the account holder. Signup policies are
recorded once per child with the guardian as the acceptor, which is the
record that actually means something. A family that half-creates is rolled
back entirely rather than leaving a guardian who cannot re-register.

The booking and enrolment forms gain a "Who is this for?" picker listing
children first, so the default selection is never the parent — booking for
the wrong child is correctable, quietly billing a parent for their kid's
lesson is not. POST /bookings and POST /enrollments take an optional
student_id honoured only for that child's guardian; anything else is a 403.
That check is the authorisation boundary of the feature.

Payments and credits gain a payer: the charge names the child it was for and
the guardian who owes it, so per-child reporting is unchanged while notices,
receipts and the payment step reach the parent. Credit is held by the payer,
so one child's cancellation can settle a sibling's charge, and the daily
billing scan sends a guardian one notice covering every child.

Closes #132

Co-Authored-By: Claude Opus 5 <[email protected]>

tests/Unit/Auth/StudentHistoryTest.php

@@ -58,7 +58,7 @@ class StudentHistoryTest extends TestCase
     public function testPolicyAcceptancesResolvePolicyTitleAndVersion(): void
     {
         $this->acceptances->shouldReceive('findByStudent')->once()->with(5)->andReturn([
-            new PolicyAcceptance(9, 5, PolicyAcceptance::REG_ACCOUNT, 5, null, '2026-06-02 09:00:00', 1),
+            new PolicyAcceptance(9, 5, PolicyAcceptance::REG_ACCOUNT, 5, ipAddress: null, acceptedAt: '2026-06-02 09:00:00', id: 1),
         ]);
         $this->policyVersions->shouldReceive('findById')->with(9)
             ->andReturn(new PolicyVersion(2, 3, null, PolicyVersion::STATUS_PUBLISHED, id: 9));
@@ -177,9 +177,9 @@ class StudentHistoryTest extends TestCase
                 Payment::REG_LESSON,
                 12,
                 100.00,
-                'CAD',
-                Payment::METHOD_CARD,
-                Payment::STATUS_PAID,
+                currency: 'CAD',
+                method: Payment::METHOD_CARD,
+                status: Payment::STATUS_PAID,
                 taxRate: 13.0,
                 taxAmount: 13.00,
                 receiptNumber: 'USC-7',
@@ -231,7 +231,7 @@ class StudentHistoryTest extends TestCase
     public function testCreditsBuildDisplayRows(): void
     {
         $this->credits->shouldReceive('findByStudent')->once()->with(5)->andReturn([
-            new Credit(5, 33.00, 13.00, 'CAD', 12, 77, 'Credit for cancelled lesson #77', Credit::STATUS_AVAILABLE, '2026-07-01 09:00:00', id: 300),
+            new Credit(5, 33.00, 13.00, currency: 'CAD', sourcePaymentId: 12, sourceLessonId: 77, reason: 'Credit for cancelled lesson #77', status: Credit::STATUS_AVAILABLE, createdAt: '2026-07-01 09:00:00', id: 300),
         ]);
 
         $rows = $this->history->credits(5);