fix: empty status filter, hidden-field probing, own private posts

Review fix round 2: content-query no longer lets get_posts() fall back
to 'publish' when every requested status is capability-gated out (now
short-circuits to an empty page). Its field filter shares PostPresenter's
hidden-field rule (Pods password type, protected meta) so a hidden key
is rejected like an unknown one instead of reaching the query. Password
fields are now type-checked as strings on write. A user without
edit_private_posts can still query their own private posts when the
query is already author-restricted, matching WordPress core.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Integrations/WordPress/Schema/FieldValidator.php

@@ -98,6 +98,7 @@ final class FieldValidator
         switch ($field->type) {
             case 'string':
             case 'text':
+            case 'password':
                 return is_string($value) ? null : 'Text erwartet.';
             case 'integer':
                 return is_int($value) ? null : 'Ganzzahl erwartet.';