Merge pull request 'Lock the registration email to the invite only when the invite is redeemable' (#82) from fix/invite-email-lock into main

Reviewed-on: #82

templates/frontend/register-page.php

@@ -7,6 +7,7 @@ if (! defined('ABSPATH')) {
 
 /**
  * @var \Unsupervised\Schedular\Auth\Invite|null $invite
+ * @var bool   $inviteValid Whether $invite can still be redeemed — only then is the email fixed.
  * @var string $token Raw invite token from the request (only its hash is stored).
  * @var bool   $canRegister
  * @var bool   $open   Whether open (self-approval) registration is enabled.
@@ -43,7 +44,7 @@ if (! defined('ABSPATH')) {
 
                 <p>
                     <label for="us-reg-email"><?php esc_html_e('Email', 'unsupervised-schedular'); ?></label>
-                    <?php if ($invite !== null) : ?>
+                    <?php if ($inviteValid && $invite !== null) : ?>
                         <input type="email" id="us-reg-email" value="<?php echo esc_attr($invite->email); ?>" readonly>
                     <?php else : ?>
                         <input type="email" name="email" id="us-reg-email" autocomplete="email" required>