feat(offers): 補齊 provider-verification 可見性缺口——子端點過濾與預約入口檢查

實作 openspec change provider-verification-gaps（8/8 tasks）：
- schedules/reviews publicList 套用 visibleToPublic，隱藏課程回 404
- MemberBookingController::store Layer 1 擋未驗證教練課程的新預約（422）
- 政策：教練被取消驗證只擋新預約，既有 pending/confirmed/completed 照常
- 主規格 Notes 已知限制轉為正式 Requirements
- 測試 +5（可見性子端點 3、預約入口 2），既有 booking/review 測試 helper
  補 verified ProviderProfile
- 容器內全套件 151 passed / 388 assertions；另以 demo 資料端到端驗證
  （已驗證教練 200/200/200、未驗證 404/404/404）

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/Feature/BookingLifecycleTest.php

@@ -7,6 +7,7 @@ use App\Enums\ScheduleStatus;
 use App\Models\Booking;
 use App\Models\CourseSchedule;
 use App\Models\DivingOffer;
+use App\Models\ProviderProfile;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Notification;
@@ -37,9 +38,16 @@ class BookingLifecycleTest extends TestCase
         return User::factory()->create(['role' => 'member']);
     }
 
-    private function makeProvider(): User
+    private function makeProvider(bool $isVerified = true): User
     {
-        return User::factory()->create(['role' => 'provider']);
+        $provider = User::factory()->create(['role' => 'provider']);
+
+        ProviderProfile::create([
+            'user_id'     => $provider->id,
+            'is_verified' => $isVerified,
+        ]);
+
+        return $provider;
     }
 
     private function makeOffer(User $provider): DivingOffer
@@ -140,6 +148,43 @@ class BookingLifecycleTest extends TestCase
         ])->assertStatus(422);
     }
 
+    // ── 可見性繞過防護（provider-verification 規格） ─────────
+
+    public function test_cannot_book_unverified_provider_course_via_schedule_id(): void
+    {
+        $unverified = $this->makeProvider(isVerified: false);
+        $schedule   = $this->makeSchedule($this->makeOffer($unverified));
+
+        $this->actingAs($this->makeMember())->postJson('/api/member/bookings', [
+            'schedule_id'  => $schedule->id,
+            'participants' => 1,
+        ])->assertStatus(422)
+          ->assertJsonPath('message', '此課程目前不開放預約');
+
+        $this->assertSame(0, Booking::count());
+    }
+
+    public function test_existing_confirmed_booking_survives_provider_unverification(): void
+    {
+        $provider = $this->makeProvider();
+        $schedule = $this->makeSchedule($this->makeOffer($provider), ['current_participants' => 1]);
+        $member   = $this->makeMember();
+        $booking  = $this->makeBooking($member, $schedule, BookingStatus::Confirmed);
+
+        // 教練在預約成立後被取消驗證：只擋新預約，不毀既有合約
+        $provider->providerProfile->update(['is_verified' => false]);
+
+        $this->actingAs($member)
+            ->getJson("/api/bookings/{$booking->id}/messages")
+            ->assertOk();
+
+        $this->actingAs($provider)
+            ->putJson("/api/provider/bookings/{$booking->id}/complete")
+            ->assertOk();
+
+        $this->assertSame(BookingStatus::Completed, $booking->fresh()->status);
+    }
+
     // ── Provider 確認 / 拒絕 ─────────────────────────────────
 
     public function test_provider_confirms_pending_booking_and_occupies_spots(): void

tests/Feature/BookingOversellTest.php

@@ -7,6 +7,7 @@ use App\Enums\ScheduleStatus;
 use App\Models\Booking;
 use App\Models\CourseSchedule;
 use App\Models\DivingOffer;
+use App\Models\ProviderProfile;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Notification;
@@ -33,6 +34,11 @@ class BookingOversellTest extends TestCase
     {
         $provider = User::factory()->create(['role' => 'provider']);
 
+        ProviderProfile::create([
+            'user_id'     => $provider->id,
+            'is_verified' => true,
+        ]);
+
         $offer = DivingOffer::create([
             'provider_id' => $provider->id,
             'title'       => 'Oversell Course',

tests/Feature/DivingOfferVisibilityTest.php

@@ -98,6 +98,33 @@ class DivingOfferVisibilityTest extends TestCase
             ->assertJsonPath('data.title', 'Visible Course');
     }
 
+    // ── 公開子端點套用相同可見性 ─────────────────────────────
+
+    public function test_schedules_endpoint_returns_404_for_unverified_provider_offer(): void
+    {
+        $unverified = $this->makeProvider(false);
+        $offer = $this->makeOffer($unverified->id, 'Hidden Schedules Course');
+
+        $this->getJson("/api/diving-offers/{$offer->id}/schedules")->assertStatus(404);
+    }
+
+    public function test_reviews_endpoint_returns_404_for_unverified_provider_offer(): void
+    {
+        $unverified = $this->makeProvider(false);
+        $offer = $this->makeOffer($unverified->id, 'Hidden Reviews Course');
+
+        $this->getJson("/api/diving-offers/{$offer->id}/reviews")->assertStatus(404);
+    }
+
+    public function test_sub_endpoints_work_for_verified_provider_offer(): void
+    {
+        $verified = $this->makeProvider(true);
+        $offer = $this->makeOffer($verified->id, 'Visible Sub Course');
+
+        $this->getJson("/api/diving-offers/{$offer->id}/schedules")->assertOk();
+        $this->getJson("/api/diving-offers/{$offer->id}/reviews")->assertOk();
+    }
+
     // ── 驗證狀態切換立即生效（快取失效） ─────────────────────
 
     public function test_toggle_verified_takes_effect_immediately_despite_cache(): void

tests/Feature/ReviewTest.php

@@ -6,6 +6,7 @@ use App\Enums\BookingStatus;
 use App\Models\Booking;
 use App\Models\CourseSchedule;
 use App\Models\DivingOffer;
+use App\Models\ProviderProfile;
 use App\Models\Review;
 use App\Models\ReviewEdit;
 use App\Models\ReviewVote;
@@ -32,6 +33,8 @@ class ReviewTest extends TestCase
     private function createOffer(): DivingOffer
     {
         $provider = User::factory()->create(['role' => 'provider']);
+        // 公開評價端點僅對已驗證教練的課程開放（provider-verification 規格）
+        ProviderProfile::create(['user_id' => $provider->id, 'is_verified' => true]);
         return DivingOffer::create([
             'provider_id' => $provider->id,
             'title'       => '測試潛水課程',