fix(2meet-data-optimizer): keep registered fields out of the public listings REST endpoints

- show_in_rest defaulted to true, so GET /wpdo/v1/listings and /listings/{id} (public by design) returned every registered hot / cold field to anonymous visitors — e.g. infocards tmeetic_ig_access_token_enc / _token_expiry / _user_id and WooCommerce _purchase_note (confirmed on dev36)
- Fields are private unless registered with show_in_rest => true; protected (underscore) and credential-like keys (token, secret, password, api key, private key, credential, salt, nonce) are never exposed
- Zone A list path no longer returns whole rows when nothing is public, and filters / orderby accept public columns only
- Version 1.1.1; CHANGELOG, readme
- Verify: unit 690 (+3), integration 525 (+3 private-column tests, RED on 1.1.0), live suite rest 2/2 (RED on 1.1.0), all live 49/49, phpcs 0, stan OK

includes/class-tmdo-rest-api.php

@@ -1396,8 +1396,13 @@ class TMDO_REST_API {
 	): WP_REST_Response {
 		global $wpdb;
 
+		// Filters and ordering only on public columns: hidden values must not be
+		// inferable by filtering or sorting on them.
 		$table   = TMDO_Zone_Hot::table( $post_type );
-		$columns = TMDO_Schema_Registry::instance()->get_hot_columns( $post_type );
+		$columns = array_intersect_key(
+			TMDO_Schema_Registry::instance()->get_hot_columns( $post_type ),
+			array_flip( TMDO_Schema_Registry::instance()->get_rest_visible_hot_columns( $post_type ) )
+		);
 
 		// Build WHERE clauses from numeric filter params.
 		$where  = array();
@@ -1443,8 +1448,8 @@ class TMDO_REST_API {
 					'post_type' => $post_type,
 				);
 				unset( $row['post_id'], $row['updated_at'] );
-				// Keep only columns with show_in_rest => true (or all if no registry entry).
-				$row = $visible_cols ? array_intersect_key( $row, $visible_cols ) : $row;
+				// Keep only public columns (none when nothing is declared public).
+				$row = array_intersect_key( $row, $visible_cols );
 				return array_merge( $item, $row );
 			},
 			$rows