Course bookings pay into the organisation's own account

Added

• Drag and drop in the form builder. List entries can be reordered by dragging, and the form's underlying structure follows the change instead of drifting out of sync.
• QR code for linking an existing account. Someone who already has a Methacore account can scan a code to link it, rather than ending up with a second one.
• Reply-to address on notification emails. An email can now carry a reply-to address, so an answer goes to the mailbox the organisation wants it in.

Improved

• A booking validates the organisation before it takes money. Checkout checks the organisation and its short name first, and the payment session is read straight from that organisation's connected account.
• A charge on a course needs a description. Creating or updating a course rejects a charge that has none, so a line item can no longer appear unlabelled.
• Connecting a payment account says what went wrong. Errors in the Stripe OAuth callback are handled and logged, and a callback arriving without a user id no longer breaks.
• Public pages now ship crawler directives, so search engines are told what they may index.

Fixed

• Course payments were routed to one fixed destination account. Funds now go to the organisation's own connected account, the application fee calculation was reworked along with it, and a redundant routing parameter is gone.
• Booking metadata differed depending on which path created the checkout session, and is now normalised.
• The public course page had misaligned elements in its layout.