fix(security): honour Pods field restrictions (audit M4)

PodsFieldSource maps hidden, read_only, admin_only and
restrict_role/-capability like Pods' own view: hidden -> new status
HIDDEN, read_only -> READONLY, restricted and not permitted -> READONLY
with read_only_restricted, else HIDDEN. HIDDEN fields are not described,
read out, queried or written (they look unknown) but stay in the schema
for the media usage search; write() re-checks before Pods' save().
Required-but-restricted fields no longer block a create. Pods is not
active on DDEV: covered by unit tests with a field-option fixture.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Integrations/WordPress/Schema/ContentSchema.php

@@ -93,9 +93,13 @@ class ContentSchema
         ];
 
         if ($withFields) {
+            $visible = array_filter(
+                $this->fields($postType),
+                static fn (FieldDefinition $field): bool => $field->status !== FieldDefinition::HIDDEN
+            );
             $description['fields'] = array_values(array_map(
                 static fn (FieldDefinition $field): array => $field->toArray(),
-                $this->fields($postType)
+                $visible
             ));
         }