fix(security): honour Pods field restrictions (audit M4)

PodsFieldSource maps hidden, read_only, admin_only and
restrict_role/-capability like Pods' own view: hidden -> new status
HIDDEN, read_only -> READONLY, restricted and not permitted -> READONLY
with read_only_restricted, else HIDDEN. HIDDEN fields are not described,
read out, queried or written (they look unknown) but stay in the schema
for the media usage search; write() re-checks before Pods' save().
Required-but-restricted fields no longer block a create. Pods is not
active on DDEV: covered by unit tests with a field-option fixture.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Integrations/WordPress/Content/PostPresenterTest.php

@@ -113,11 +113,14 @@ final class PostPresenterTest extends TestCase
         $password = new FieldDefinition('secret', 'Secret', 'password', 'pods', 'writable');
         $protected = new FieldDefinition('_internal', 'Internal', 'string', 'meta', 'readonly');
         $visible = new FieldDefinition('role', 'Funktion', 'string', 'pods', 'writable');
+        $restricted = new FieldDefinition('boss', 'Boss', 'string', 'pods', FieldDefinition::HIDDEN);
         $source = Mockery::mock(FieldSource::class);
         $source->expects('read')->once()->with(5, $visible)->andReturn('Leitung');
         $schema = Mockery::mock(ContentSchema::class);
         $schema->allows('taxonomies')->andReturn([]);
-        $schema->allows('fields')->andReturn(['secret' => $password, '_internal' => $protected, 'role' => $visible]);
+        $schema->allows('fields')->andReturn([
+            'secret' => $password, '_internal' => $protected, 'role' => $visible, 'boss' => $restricted,
+        ]);
         $schema->allows('sourceOf')->andReturn($source);
         $post = new WP_Post(['ID' => 5, 'post_type' => 'lit_person']);