fix: restrict content-query by cap before pagination, filter hidden fields

Review fix round 1: content-query now excludes posts/statuses the user
cannot edit before querying (author restriction without edit_others_posts,
status filtering by edit_private_posts/edit_published_posts) instead of
only dropping them after fetching, and rejects unknown field/taxonomy
filters. content-types' not-found hint only lists editable types.
PostPresenter skips Pods password fields and readonly protected meta.
Query input gains search/terms length limits.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Integrations/WordPress/Content/PostPresenter.php

@@ -7,6 +7,7 @@ namespace LIT\MCP\Integrations\WordPress\Content;
 use LIT\MCP\Abilities\JsonMap;
 use LIT\MCP\Abilities\Rev;
 use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
+use LIT\MCP\Integrations\WordPress\Schema\FieldDefinition;
 use WP_Post;
 
 /**
@@ -143,12 +144,31 @@ class PostPresenter
     {
         $result = [];
         foreach ($this->schema->fields((string) $post->post_type) as $key => $field) {
+            if ($this->isHidden($field)) {
+                continue;
+            }
+
             $result[$key] = $this->schema->sourceOf($field)->read((int) $post->ID, $field);
         }
 
         return $result;
     }
 
+    /**
+     * Pods password fields and readonly protected meta (WordPress' own "_"-prefixed
+     * internal keys) are never read out via lit-content-get/-query: neither belongs in
+     * front of the model, and both are one plugin registration away from leaking secrets
+     * or internal engine state.
+     */
+    private function isHidden(FieldDefinition $field): bool
+    {
+        if ($field->type === 'password') {
+            return true;
+        }
+
+        return $field->status !== FieldDefinition::WRITABLE && str_starts_with($field->key, '_');
+    }
+
     /** @return array{id: int, url: string, alt: string}|null */
     private function featuredImage(WP_Post $post): ?array
     {