feat: add native WordPress Abilities API support

[wachiravit-thitagran]

Summary

This pull request adds native WordPress Abilities API support to Tutor LMS.

It introduces a dedicated Tutor LMS ability category and a focused set of read-only abilities for common course, curriculum, learner progress, and environment information:

• tutor-lms/site-info
• tutor-lms/list-courses
• tutor-lms/get-course
• tutor-lms/get-course-structure
• tutor-lms/get-student-progress

What this adds

• Native registration through wp_register_ability_category() and wp_register_ability()
• Neutral, domain-focused labels and descriptions that are useful to any WordPress Abilities consumer
• Structured input schemas for each ability
• Read-only, non-destructive, idempotent metadata
• Existing WordPress and Tutor LMS authorization checks are preserved
• Unpublished course data is only returned to users who can edit the relevant course
• Curriculum discovery respects the existing tutor_course_contents_post_types filter
• Learner progress is restricted to the learner or users with appropriate administrative capabilities
• Automated tests for hook registration and ability registration when the WordPress Abilities API is available

Backward compatibility

Tutor LMS currently supports WordPress versions that do not provide the WordPress Abilities API.

This integration is therefore optional:

• When the Abilities API is available, Tutor LMS registers its abilities.
• On older WordPress versions, Tutor LMS continues to work normally without calling unavailable Abilities API functions.
• No additional plugin or external service is required.

Permissions and data access

The abilities do not bypass existing WordPress or Tutor LMS authorization.

Examples:

• Public course information can be read by authenticated users with the read capability.
• Unpublished courses require permission to edit the course.
• Unpublished curriculum items are not returned to users who cannot edit the parent course.
• Learner progress can only be read by the learner or users with appropriate administrative capabilities.

AI and automation safety

WordPress abilities can be consumed by AI agents, automation systems, remote clients, or other WordPress integrations.

Ability metadata, descriptions, and schemas are interface information only and must not be treated as authorization. Permission and capability checks must always be enforced server-side for every execution.

The abilities introduced in this PR are intentionally read-only and marked non-destructive and idempotent. Any future write abilities should continue to:

• enforce WordPress and Tutor LMS permissions server-side;
• clearly identify destructive or state-changing behavior;
• avoid exposing secrets or sensitive internal data;
• validate all input independently of the calling client;
• use appropriate capability checks for the affected resource.

This helps make the abilities safe for both traditional integrations and AI-driven automation.

Testing

A new AbilitiesTest covers:

• WordPress Abilities API hook registration;
• registration of all Tutor LMS abilities when the API is available;
• graceful skipping when the test environment runs an older WordPress version without the Abilities API.