Fix five findings from a security assessment of the plugin

The assessment looked for three things: whether students can reach each
other's bookings, whether payment settings can be dodged, and whether the
plugin opens a way into the rest of the install. The student-isolation and
payment paths held up. These are what did not.

- The front-end login form told WordPress not to work out whether the site
  was secure, so on HTTPS every student's session cookie was issued without
  the Secure flag. wp_signon() only derives it from is_ssl() when the second
  argument is left at its default; an explicit false reads like "no
  preference" and is not.

- The update check took whatever download URL the release API returned and
  handed it to core, which unpacks it over the installed plugin. The package
  must now be https on git.unsupervised.ca exactly, compared on the parsed
  host so a lookalike name cannot pass.

- Uninstalling dropped 2 of 14 tables and left the Stripe secret and webhook
  signing key in wp_options. Removal is now a choice made in advance on
  Access -> Plugin removal: records are kept unless the owner opts in (with a
  typed confirmation), while credentials and the borrowed core registration
  settings go every time.

- Open registration switches on the site-wide users_can_register and makes
  Student the default role, arming any other signup form on the site to mint
  students who could book and be billed immediately. The pending state is now
  decided once, on user_register, rather than by whichever form created the
  account.

- Cancel and withdraw answered "not yours" differently from "does not exist",
  which let a signed-in student enumerate the studio's bookings. Both now
  give the same 404.

Co-Authored-By: Claude Opus 5 <[email protected]>

tests/Unit/Update/UpdateCheckerTest.php

@@ -13,6 +13,17 @@ class UpdateCheckerTest extends TestCase
     private const PLUGIN_FILE = 'unsupervised-schedular/unsupervised-schedular.php';
     private const PACKAGE_URL = 'https://git.unsupervised.ca/attachments/abc123';
 
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        // The package URL is checked against the release host before it is
+        // offered to core, so every path through provideUpdate() reaches this.
+        Functions\when('wp_parse_url')->alias(
+            static fn(string $url, int $component = -1): mixed => parse_url($url, $component)
+        );
+    }
+
     /** Stub a successful Gitea API response with the given decoded body. */
     private function stubApiResponse(int $code, mixed $body): void
     {
@@ -217,6 +228,63 @@ class UpdateCheckerTest extends TestCase
         self::assertSame($this->noUpdatePayload(), $result);
     }
 
+    /**
+     * A package URL is code core will download and unpack over the installed
+     * plugin, so an answer naming somewhere other than the release host is not
+     * an update — whoever gave it, and however plausible the version.
+     *
+     * @dataProvider untrustedPackageUrls
+     */
+    public function testPackageHostedAnywhereButTheReleaseHostIsRefused(string $url): void
+    {
+        Functions\when('plugin_basename')->justReturn(self::PLUGIN_FILE);
+        Functions\when('get_transient')->justReturn(false);
+        Functions\when('set_transient')->justReturn(true);
+        $this->stubApiResponse(200, $this->release('v9.9.9', [
+            ['name' => 'unsupervised-schedular-9.9.9.zip', 'browser_download_url' => $url],
+        ]));
+
+        $result = (new UpdateChecker())->provideUpdate(false, [], self::PLUGIN_FILE);
+
+        // Refused exactly as a release with no zip at all: nothing to install,
+        // and the plugin stays in `no_update` so the toggle does not vanish.
+        self::assertSame($this->noUpdatePayload(), $result);
+    }
+
+    /** @return array<string, array{string}> */
+    public static function untrustedPackageUrls(): array
+    {
+        return [
+            'unrelated host'      => ['https://evil.test/unsupervised-schedular-9.9.9.zip'],
+            // Would pass a naive "contains" or "ends with" check.
+            'lookalike prefix'    => ['https://evil-git.unsupervised.ca/plugin.zip'],
+            'lookalike suffix'    => ['https://git.unsupervised.ca.evil.test/plugin.zip'],
+            'subdomain'           => ['https://cdn.git.unsupervised.ca/plugin.zip'],
+            'credentials in host' => ['https://[email protected]/plugin.zip'],
+            'plain http'          => ['http://git.unsupervised.ca/attachments/abc123'],
+            'no scheme'           => ['git.unsupervised.ca/attachments/abc123'],
+            'empty'               => [''],
+        ];
+    }
+
+    public function testAZipFromTheReleaseHostIsStillOfferedAfterAnUntrustedOne(): void
+    {
+        Functions\when('plugin_basename')->justReturn(self::PLUGIN_FILE);
+        Functions\when('get_transient')->justReturn(false);
+        Functions\when('set_transient')->justReturn(true);
+        $this->stubApiResponse(200, $this->release('v9.9.9', [
+            ['name' => 'decoy.zip', 'browser_download_url' => 'https://evil.test/decoy.zip'],
+            $this->zipAsset(),
+        ]));
+
+        $result = (new UpdateChecker())->provideUpdate(false, [], self::PLUGIN_FILE);
+
+        // The scan does not stop at the first zip it sees — it stops at the
+        // first one it would actually install.
+        self::assertIsArray($result);
+        self::assertSame(self::PACKAGE_URL, $result['package']);
+    }
+
     public function testMalformedApiBodyOffersNoUpdatePayload(): void
     {
         Functions\when('plugin_basename')->justReturn(self::PLUGIN_FILE);