fix: guard allowedRoles() against corrupt filtered results

The lit_mcp_allowed_roles filter could return a non-array, causing
array_filter() to throw TypeError in PHP 8.1+. Now fallback to
['administrator'] if filter result is not an array.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Access.php

@@ -46,6 +46,9 @@ final class Access
         }
 
         $roles = apply_filters('lit_mcp_allowed_roles', $roles);
+        if (! is_array($roles)) {
+            $roles = self::DEFAULT_ROLES;
+        }
 
         return array_values(array_filter($roles, 'is_string'));
     }

tests/Unit/AccessTest.php

@@ -31,6 +31,16 @@ final class AccessTest extends TestCase
         self::assertSame(['administrator', 'editor'], (new Access())->allowedRoles());
     }
 
+    public function testCorruptFilteredResultFallsBackToAdministrator(): void
+    {
+        Functions\when('get_option')->justReturn(['administrator']);
+        Filters\expectApplied('lit_mcp_allowed_roles')
+            ->once()
+            ->andReturn('editor');
+
+        self::assertSame(['administrator'], (new Access())->allowedRoles());
+    }
+
     public function testGrantsCapabilityToAllowedRole(): void
     {
         Functions\when('get_option')->justReturn(['editor']);