Track preschool planning days, partner invites and real vacation forfeiture

Three strands of work that grew together across the same settings screen and
API client, so they land as one change.

Per-year preschool planning days ("studiedagar"): new table, repository
(SQLite + Postgres), service, router and migration 007, plus the hooks and
Settings UI to plan and record them per child and year. Allocation now
reserves the recorded figure for a year where one exists and only falls back
to the child-level estimate otherwise, marking that fallback as assumed.

Partner invitations: workspaces issue and list invitations, registration
accepts an invite token to join the inviter's workspace instead of creating a
personal one, and a /join/:token page plus the settings invite panel drive it.

Vacation forfeiture: tips and the dashboard now distinguish days a parent
genuinely loses from days that merely age, so the warning stops firing on
balances that were never at risk.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/tests/unit/test_workspace_service.py

@@ -410,14 +410,77 @@ class TestInvitationScoping:
         with pytest.raises(InvitationError, match="already belong"):
             await workspace_service.redeem_invitation(token, seeded_ids.personal_data_uuid)
 
-    async def test_redeem_refuses_when_workspace_already_has_two_members(
+    async def test_redeem_claims_placeholder_instead_of_refusing_when_full_of_a_placeholder(
         self,
         workspace_service: WorkspaceService,
         seeded_ids: SeededIds,
         user_repo: SQLiteUserRepository,
     ) -> None:
-        # Fill the target workspace to its 2-member cap first.
-        await workspace_service.add_placeholder_parent(seeded_ids.workspace_id, "Partner")
+        """Regression for "the second parent can't log in": the target
+        workspace's second slot is commonly a placeholder auto-created by the
+        onboarding wizard (`add_placeholder_parent`), not a genuinely full
+        workspace. Redemption must CLAIM that placeholder -- re-pointing the
+        redeemer's login onto it and preserving whatever plan data the
+        placeholder already holds -- rather than refusing with "maximum
+        number of members", which used to make the entire invite happy path
+        impossible (see `WorkspaceService.redeem_invitation` docstring)."""
+        placeholder = await workspace_service.add_placeholder_parent(
+            seeded_ids.workspace_id, "Partner"
+        )
+
+        other_ws = await workspace_service.create_workspace("Other WS")
+        redeemer_pd = await workspace_service.add_placeholder_parent(other_ws.id, "Redeemer")
+        redeemer_user = await user_repo.create(
+            User(
+                id=uuid4(),
+                personal_data_uuid=redeemer_pd.uuid,
+                email="redeemer@example.com",
+                hashed_password="not-a-real-hash",
+                created_at=datetime.now(),
+            )
+        )
+
+        token = await workspace_service.invite_partner(
+            seeded_ids.workspace_id, await _make_inviter(user_repo, seeded_ids.personal_data_uuid)
+        )
+        inv = await workspace_service.redeem_invitation(token, redeemer_pd.uuid)
+        assert inv.status == "accepted"
+
+        # Login re-pointed onto the placeholder, not left on the (now
+        # discarded) auto-created profile.
+        refreshed_user = await user_repo.get_by_id(redeemer_user.id)
+        assert refreshed_user is not None
+        assert refreshed_user.personal_data_uuid == placeholder.uuid
+
+        # The placeholder took over the redeemer's already-chosen name.
+        members = await workspace_service.list_members(seeded_ids.workspace_id)
+        assert {m.name for m in members} == {"Test Parent", "Redeemer"}
+
+        # The redeemer's own auto-created profile is gone -- not left behind
+        # as a second, orphaned membership of the target workspace.
+        assert await workspace_service._pd.get_by_id(redeemer_pd.uuid) is None
+
+    async def test_redeem_refuses_when_both_slots_have_real_logins(
+        self,
+        workspace_service: WorkspaceService,
+        seeded_ids: SeededIds,
+        user_repo: SQLiteUserRepository,
+    ) -> None:
+        """Unlike the placeholder case above, a workspace whose second slot
+        is a real, logged-in member has genuinely no room -- redemption must
+        still be refused."""
+        second_member = await workspace_service.add_placeholder_parent(
+            seeded_ids.workspace_id, "Partner"
+        )
+        await user_repo.create(
+            User(
+                id=uuid4(),
+                personal_data_uuid=second_member.uuid,
+                email="partner@example.com",
+                hashed_password="not-a-real-hash",
+                created_at=datetime.now(),
+            )
+        )
 
         other_ws = await workspace_service.create_workspace("Other WS")
         other_pd = await workspace_service.add_placeholder_parent(other_ws.id, "Redeemer")
@@ -427,3 +490,45 @@ class TestInvitationScoping:
         )
         with pytest.raises(InvitationError, match="maximum number of members"):
             await workspace_service.redeem_invitation(token, other_pd.uuid)
+
+    async def test_redeem_refuses_claim_when_redeemer_has_dependent_plan_data(
+        self,
+        workspace_service: WorkspaceService,
+        seeded_ids: SeededIds,
+        user_repo: SQLiteUserRepository,
+        vacation_repo: SQLiteVacationDaysRepository,
+    ) -> None:
+        """A redeemer who already entered plan data under their own profile
+        cannot be safely claimed onto the placeholder: `vacation_days` (and
+        siblings) denormalize `workspace_id` alongside `personal_data_uuid`,
+        and no repository method exists to repoint that column -- silently
+        discarding or merging it would lose or corrupt data, so this is
+        refused instead."""
+        await workspace_service.add_placeholder_parent(seeded_ids.workspace_id, "Partner")
+
+        other_ws = await workspace_service.create_workspace("Other WS")
+        redeemer_pd = await workspace_service.add_placeholder_parent(other_ws.id, "Redeemer")
+        await user_repo.create(
+            User(
+                id=uuid4(),
+                personal_data_uuid=redeemer_pd.uuid,
+                email="redeemer2@example.com",
+                hashed_password="not-a-real-hash",
+                created_at=datetime.now(),
+            )
+        )
+        await vacation_repo.create(
+            VacationDays(
+                id=uuid4(),
+                personal_data_uuid=redeemer_pd.uuid,
+                workspace_id=other_ws.id,
+                year=2026,
+                total_days=25,
+            )
+        )
+
+        token = await workspace_service.invite_partner(
+            seeded_ids.workspace_id, await _make_inviter(user_repo, seeded_ids.personal_data_uuid)
+        )
+        with pytest.raises(InvitationError, match="vacation_days"):
+            await workspace_service.redeem_invitation(token, redeemer_pd.uuid)