Demo follow-ups: editable policy name, one-page signup, group classes in upcoming lessons, deletion cleanup

Five items from the latest demo pass:

- A policy's title can be edited from the Policies screen. Only the title
  moves; the slug is what the gates resolve policies by, so a rename can
  never detach a policy from acceptances already recorded against it.
- Signup is one page again. The studio's registration questions move from
  a second step behind "Next" onto the main form, in an "About you" panel
  above the students being added, and that panel also asks an adult
  student for their birth year (the same us_birth_year meta a child's
  uses). register.js disables and hides the whole panel for a pure
  guardian, since the questions describe a student.
- The password is re-scored on submit, not only as it is typed. zxcvbn's
  dictionary arrives after page load, so a password typed straight away
  was never scored at all and the first the student heard of it was the
  server rejecting the whole form.
- Group-class sessions appear alongside lessons wherever upcoming lessons
  are listed: the [us_scheduler] panel (students and instructors) and the
  admin student detail page. GroupClass\SessionSchedule derives them from
  Offering::sessionWindows(), the same derivation the billing scan uses.
  They carry kind = 'group_class' and no Cancel action - a session is one
  date in a term, not a booked slot.
- Deleting a user releases what the account was holding: each upcoming
  lesson is cancelled, its slot freed for rebooking, its pending payment
  voided, and active class enrolments cancelled. Past lessons and paid
  history are left alone.

Tests: composer test (851), composer lint, composer cs all pass.

Co-Authored-By: Claude Opus 5 <[email protected]>

src/Booking/BookingEndpoint.php

@@ -5,6 +5,7 @@ namespace Unsupervised\Schedular\Booking;
 
 use Unsupervised\Schedular\Availability\AvailabilityRepository;
 use Unsupervised\Schedular\Auth\RoleManager;
+use Unsupervised\Schedular\GroupClass\SessionSchedule;
 use Unsupervised\Schedular\Guardian\GuardianService;
 use Unsupervised\Schedular\Offering\Offering;
 use Unsupervised\Schedular\Offering\OfferingRepository;
@@ -30,6 +31,7 @@ class BookingEndpoint {
 		private PaymentService $payments,
 		private CancellationPolicy $cancellationPolicy,
 		private GuardianService $guardians,
+		private SessionSchedule $sessions,
 	) {}
 
 	/**
@@ -124,20 +126,35 @@ class BookingEndpoint {
 
 	public function myLessons( \WP_REST_Request $request ): \WP_REST_Response { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found
 		$userId = get_current_user_id();
+		$now    = current_time( 'mysql' );
 
+		// Group classes are listed here too. A term-based class has no row in
+		// us_availability, so nothing that only read lessons could show one, and a
+		// student whose whole week was a group class saw an empty schedule.
 		if ( current_user_can( RoleManager::CAP_MANAGE_AVAILABILITY ) ) {
 			$lessons = $this->bookings->findUpcomingForInstructor( $userId );
+
+			// One row per session the instructor teaches, not per student in it.
+			$sessions = array_map(
+				static fn( array $session ): array => $session + [ 'kind' => SessionSchedule::KIND ],
+				$this->sessions->upcomingForInstructor( $userId, $now )
+			);
 		} else {
 			// A guardian's list covers the whole household — their own lessons and
 			// every child's — merged and re-sorted so the soonest is first
 			// regardless of whose it is.
-			$lessons = [];
+			$lessons  = [];
+			$sessions = [];
 			foreach ( $this->guardians->householdIds( $userId ) as $studentId ) {
-				$lessons = array_merge( $lessons, $this->bookings->findUpcomingForStudent( $studentId ) );
+				$lessons  = array_merge( $lessons, $this->bookings->findUpcomingForStudent( $studentId ) );
+				$sessions = array_merge( $sessions, $this->sessionRows( $studentId, $now ) );
 			}
 		}
 
-		$rows = array_map( fn( Lesson $l ): array => $this->lessonWithTimes( $l ), $lessons );
+		$rows = array_merge(
+			array_map( fn( Lesson $l ): array => $this->lessonWithTimes( $l ), $lessons ),
+			$sessions
+		);
 
 		// usort reindexes in place, so the response is already a list.
 		usort( $rows, static fn( array $a, array $b ): int => Val::string( $a['start_dt'] ?? '' ) <=> Val::string( $b['start_dt'] ?? '' ) );
@@ -145,6 +162,23 @@ class BookingEndpoint {
 		return new \WP_REST_Response( $rows, 200 );
 	}
 
+	/**
+	 * One student's upcoming group-class sessions, shaped like the lesson rows
+	 * beside them so a single list renders both. `kind` is what tells them apart:
+	 * a session is not a booked slot, so it carries no cancel action.
+	 *
+	 * @return list<array<string, mixed>>
+	 */
+	private function sessionRows( int $studentId, string $now ): array {
+		return array_map(
+			fn( array $session ): array => $session + [
+				'kind'         => SessionSchedule::KIND,
+				'student_name' => $this->guardians->studentName( $studentId ),
+			],
+			$this->sessions->upcomingForStudent( $studentId, $now )
+		);
+	}
+
 	/**
 	 * A lesson's array form plus its slot's start/end times and the booked
 	 * offering's name, so front-end lists can show what the session is and when