fix(security): honour Pods field restrictions (audit M4)

PodsFieldSource maps hidden, read_only, admin_only and
restrict_role/-capability like Pods' own view: hidden -> new status
HIDDEN, read_only -> READONLY, restricted and not permitted -> READONLY
with read_only_restricted, else HIDDEN. HIDDEN fields are not described,
read out, queried or written (they look unknown) but stay in the schema
for the media usage search; write() re-checks before Pods' save().
Required-but-restricted fields no longer block a create. Pods is not
active on DDEV: covered by unit tests with a field-option fixture.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Integrations/WordPress/Schema/FieldValidatorTest.php

@@ -32,6 +32,7 @@ final class FieldValidatorTest extends TestCase
             'secret' => new FieldDefinition('_secret', '_secret', 'string', 'meta', 'readonly'),
             'city' => new FieldDefinition('city', 'city', 'unknown', 'sample', 'unknown'),
             'pin' => new FieldDefinition('pin', 'PIN', 'password', 'pods', 'writable'),
+            'boss' => new FieldDefinition('boss', 'Boss', 'string', 'pods', FieldDefinition::HIDDEN),
         ];
     }
 
@@ -72,8 +73,10 @@ final class FieldValidatorTest extends TestCase
             'mentor' => 7,
             'photos' => 3,
             'start' => '01.10.2026',
+            'boss' => 'x',
         ], false)['errors'];
 
+        self::assertSame($errors['nope'], $errors['boss'], 'a hidden field looks like an unknown one (M4)');
         self::assertStringContainsString('lit-content-types', $errors['nope']);
         self::assertSame('Feld ist schreibgeschützt.', $errors['secret']);
         self::assertSame('Erlaubte Werte: junior, senior.', $errors['level']);
@@ -123,4 +126,15 @@ final class FieldValidatorTest extends TestCase
         self::assertCount(1, $result['warnings']);
         self::assertStringContainsString('city', $result['warnings'][0]);
     }
+
+    /** M4: a required field the user cannot write (restricted Pods field) cannot block a create. */
+    public function testRequiredButRestrictedFieldsAreNotDemanded(): void
+    {
+        $definitions = [
+            'boss' => new FieldDefinition('boss', 'Boss', 'string', 'pods', FieldDefinition::HIDDEN, true),
+            'fixed' => new FieldDefinition('fixed', 'Fest', 'string', 'pods', FieldDefinition::READONLY, true),
+        ];
+
+        self::assertSame([], (new FieldValidator())->validate($definitions, [], true)['errors']);
+    }
 }