fix(security): honour Pods field restrictions (audit M4)

PodsFieldSource maps hidden, read_only, admin_only and
restrict_role/-capability like Pods' own view: hidden -> new status
HIDDEN, read_only -> READONLY, restricted and not permitted -> READONLY
with read_only_restricted, else HIDDEN. HIDDEN fields are not described,
read out, queried or written (they look unknown) but stay in the schema
for the media usage search; write() re-checks before Pods' save().
Required-but-restricted fields no longer block a create. Pods is not
active on DDEV: covered by unit tests with a field-option fixture.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Integrations/WordPress/Content/PostPresenter.php

@@ -180,6 +180,7 @@ class PostPresenter
     }
 
     /**
+     * Fields hidden for the current user (FieldDefinition::HIDDEN, e.g. restricted Pods fields),
      * Pods password fields and readonly protected meta (WordPress' own "_"-prefixed
      * internal keys) are never read out via lit-content-get/-query: neither belongs in
      * front of the model, and both are one plugin registration away from leaking secrets
@@ -189,7 +190,7 @@ class PostPresenter
      */
     public static function isHiddenField(FieldDefinition $field): bool
     {
-        if ($field->type === 'password') {
+        if ($field->type === 'password' || $field->status === FieldDefinition::HIDDEN) {
             return true;
         }
 

src/Integrations/WordPress/Schema/ContentSchema.php

@@ -93,9 +93,13 @@ class ContentSchema
         ];
 
         if ($withFields) {
+            $visible = array_filter(
+                $this->fields($postType),
+                static fn (FieldDefinition $field): bool => $field->status !== FieldDefinition::HIDDEN
+            );
             $description['fields'] = array_values(array_map(
                 static fn (FieldDefinition $field): array => $field->toArray(),
-                $this->fields($postType)
+                $visible
             ));
         }
 

src/Integrations/WordPress/Schema/FieldDefinition.php

@@ -13,6 +13,13 @@ final class FieldDefinition
     public const READONLY = 'readonly';
     public const UNKNOWN = 'unknown';
 
+    /**
+     * Not for the current user (e.g. a Pods field restricted to admins or marked hidden, security
+     * audit M4): never read out, described or written – it looks like an unknown field. Kept in
+     * the schema so the media usage search still sees attachment IDs stored in it.
+     */
+    public const HIDDEN = 'hidden';
+
     /**
      * @param list<array{value: string, label: string}>|null $choices
      * @param array{object_type: string, name: ?string}|null  $related

src/Integrations/WordPress/Schema/FieldValidator.php

@@ -27,7 +27,7 @@ final class FieldValidator
         foreach ($values as $key => $value) {
             $key = (string) $key;
             $field = $definitions[$key] ?? null;
-            if ($field === null) {
+            if ($field === null || $field->status === FieldDefinition::HIDDEN) {
                 $errors[$key] = 'Unbekanntes Feld; verfügbare Felder über lit/content-types (direkt: '
                     . 'lit-content-types) abrufen.';
                 continue;
@@ -55,7 +55,9 @@ final class FieldValidator
         }
 
         foreach ($definitions as $key => $field) {
-            if (! $field->required || isset($errors[$key])) {
+            // A field the user cannot write (readonly, hidden) cannot be required from them either.
+            $writable = in_array($field->status, [FieldDefinition::WRITABLE, FieldDefinition::UNKNOWN], true);
+            if (! $field->required || ! $writable || isset($errors[$key])) {
                 continue;
             }