fix: empty status filter, hidden-field probing, own private posts

Review fix round 2: content-query no longer lets get_posts() fall back
to 'publish' when every requested status is capability-gated out (now
short-circuits to an empty page). Its field filter shares PostPresenter's
hidden-field rule (Pods password type, protected meta) so a hidden key
is rejected like an unknown one instead of reaching the query. Password
fields are now type-checked as strings on write. A user without
edit_private_posts can still query their own private posts when the
query is already author-restricted, matching WordPress core.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Integrations/WordPress/Schema/FieldValidatorTest.php

@@ -31,6 +31,7 @@ final class FieldValidatorTest extends TestCase
             'start' => new FieldDefinition('start', 'Beginn', 'date', 'pods', 'writable'),
             'secret' => new FieldDefinition('_secret', '_secret', 'string', 'meta', 'readonly'),
             'city' => new FieldDefinition('city', 'city', 'unknown', 'sample', 'unknown'),
+            'pin' => new FieldDefinition('pin', 'PIN', 'password', 'pods', 'writable'),
         ];
     }
 
@@ -90,6 +91,14 @@ final class FieldValidatorTest extends TestCase
         self::assertSame('5 ist kein Medium der Mediathek.', $errors['photos']);
     }
 
+    public function testPasswordFieldsAreValidatedAsStrings(): void
+    {
+        $validator = new FieldValidator();
+
+        self::assertSame([], $validator->validate($this->definitions(), ['pin' => '1234'], false)['errors']);
+        self::assertSame('Text erwartet.', $validator->validate($this->definitions(), ['pin' => 1234], false)['errors']['pin']);
+    }
+
     public function testUnknownTypedFieldsAreAcceptedWithAWarningAndNullClears(): void
     {
         $result = (new FieldValidator())->validate($this->definitions(), ['city' => ['any' => 'thing'], 'level' => null], false);