Courses, paid bookings, waitlists and passkeys

Added

• Courses. Courses can be created, edited, archived and deleted, sorted onto boards, assigned to a trainer, and blocked for individual dates. Each course carries its price, its charges and its discounts, keeps a participant group in sync, and shows up in the app with image and description.
• Paid bookings through Stripe. An organisation connects its own payment methods and takes payment for a booking; a refund goes back the same way. Discount codes lower the price, and the page after a successful booking breaks down what was actually charged.
• A waitlist that fills freed seats. Capacity is now allocated on the server, so a booking into a full course lands on the waitlist. When a seat opens up it is offered automatically, and when a course changes the existing waitlist entries are carried over and the people on it are notified.
• An email for every step of a booking. Booker and participant are notified when a booking is made, when its status changes, and when a waitlist seat is offered to them. A course can also send a message to everyone in it.
• Passkey sign-in. Registration and login work with WebAuthn, so a passkey stands in for the password. A passkey can be set up directly from the sign-in screen, which then counts as verified.
• Sign-in through an OAuth2 identity exchange. Sign-in can be verified against an external identity provider, and the authorization page now opens in the same window instead of a second one.
• Password reset on the web. A reset page that validates the form and rates the strength of the new password.
• Guided onboarding. New users are taken through a series of steps with course videos; finished steps are remembered, and each step shows a countdown.
• Trial period and upgrade. An organisation now carries a status, and the test phase has an end: once it runs out the dashboard locks, and an admin can upgrade the organisation.

Improved

• Setting up a course in the dashboard. Trainers can be searched and picked while a course is being set up, and the booking pages follow one structure with the navigation between them reworked.
• Bookings in the app. The profile and booking views load their course data themselves and can be pulled to refresh.
• Profile data comes from a cache. The user data behind the account view is cached with an expiry instead of being looked up on every call.
• The pricing table. Plan descriptions and feature details were rewritten so it is clearer what each plan contains.
• The dashboard login page. It now holds up on small screens.
• The sign-in screen on the website. The login options sit in a button grid, and the passkey prompt got its own panel in the flow.
• Support is reachable from the website footer.

Fixed

• Creating or updating a course could attach an invalid group, and group selection in the dashboard listed the same group twice.
• Signing in could fail for accounts that have no stored credentials.
• Course emails went out through the wrong mail server address, and the links to login and password reset pointed at the old addresses.
• Payments picked up the wrong Stripe credentials: courses and organisations read them inconsistently, and the dashboard used the wrong client id.
• The message for an expired session on the sign-in and password reset pages spelled out more internal detail than it should.
• Landing on the not-authorised page left the stale session cookie in place.