feat: add password change, class unenroll, and optional notify flags

Let admins skip SMS on user, class, and invoice actions, and let users change their own password with the current one.

utils/notifyFlags.test.js

@@ -0,0 +1,56 @@
+'use strict';
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert/strict');
+const { pickNotifyFlags, omitNotifyFields } = require('./notifyFlags');
+
+describe('pickNotifyFlags', () => {
+  it('defaults all channels to enabled when the body is empty', () => {
+    assert.deepEqual(pickNotifyFlags(), { sms: true, email: true, bot: true });
+    assert.deepEqual(pickNotifyFlags({}), { sms: true, email: true, bot: true });
+  });
+
+  it('reads nested notify flags and keeps unspecified channels enabled', () => {
+    assert.deepEqual(pickNotifyFlags({ notify: { sms: false } }), {
+      sms: false,
+      email: true,
+      bot: true
+    });
+  });
+
+  it('honors explicit false for email and bot', () => {
+    assert.deepEqual(pickNotifyFlags({
+      notify: { sms: true, email: false, bot: false }
+    }), {
+      sms: true,
+      email: false,
+      bot: false
+    });
+  });
+
+  it('accepts top-level aliases and string booleans', () => {
+    assert.deepEqual(pickNotifyFlags({
+      notifySms: 'false',
+      notifyEmail: 'true',
+      sendBot: '0'
+    }), {
+      sms: false,
+      email: true,
+      bot: false
+    });
+  });
+});
+
+describe('omitNotifyFields', () => {
+  it('strips notify fields without mutating the original body', () => {
+    const body = {
+      user: 'abc',
+      amount: 1000,
+      notify: { sms: false },
+      notifySms: false
+    };
+    const cleaned = omitNotifyFields(body);
+    assert.deepEqual(cleaned, { user: 'abc', amount: 1000 });
+    assert.equal(body.notifySms, false);
+  });
+});