fix(security): honour Pods field restrictions (audit M4)

PodsFieldSource maps hidden, read_only, admin_only and
restrict_role/-capability like Pods' own view: hidden -> new status
HIDDEN, read_only -> READONLY, restricted and not permitted -> READONLY
with read_only_restricted, else HIDDEN. HIDDEN fields are not described,
read out, queried or written (they look unknown) but stay in the schema
for the media usage search; write() re-checks before Pods' save().
Required-but-restricted fields no longer block a create. Pods is not
active on DDEV: covered by unit tests with a field-option fixture.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Integrations/WordPress/Schema/ContentSchemaTest.php

@@ -76,7 +76,10 @@ final class ContentSchemaTest extends TestCase
             (object) ['name' => 'post_format', 'show_ui' => false, 'hierarchical' => false, 'labels' => (object) ['name' => 'Formate']],
         ]);
         $schema = new ContentSchema(
-            [$this->source('meta', [new FieldDefinition('footnotes', 'footnotes', 'string', 'meta', 'writable')])],
+            [$this->source('meta', [
+                new FieldDefinition('footnotes', 'footnotes', 'string', 'meta', 'writable'),
+                new FieldDefinition('zz_hidden', 'Verborgen', 'string', 'pods', FieldDefinition::HIDDEN),
+            ])],
             static fn (string $type): bool => $type === 'page'
         );
 
@@ -92,6 +95,7 @@ final class ContentSchemaTest extends TestCase
         self::assertSame([['name' => 'category', 'label' => 'Kategorien', 'hierarchical' => true]], $withoutFields['taxonomies']);
         self::assertArrayNotHasKey('fields', $withoutFields);
         self::assertSame('footnotes', $withFields['fields'][0]['key']);
+        self::assertCount(1, $withFields['fields'], 'hidden (restricted) fields are not described (M4)');
         self::assertNull($schema->describe('et_pb_layout', false));
     }