The group view was marking players as "unpaid" if they had ANY unpaid
invoice (products, etc.), even if their program subscription was fully paid.

Now the logic only checks:
1. Enrollment payment_status (paid/waived = done)
2. Enrollment's linked invoice status
3. Recent subscription invoice with matching program name

Also fixed ActivateEnrollmentOnPayment listener to properly set
payment_status='paid' on enrollments when subscription invoice is paid
(was only activating status, not updating payment_status).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>