fix(2meet-data-optimizer): keep registered fields out of the public listings REST endpoints

- show_in_rest defaulted to true, so GET /wpdo/v1/listings and /listings/{id} (public by design) returned every registered hot / cold field to anonymous visitors — e.g. infocards tmeetic_ig_access_token_enc / _token_expiry / _user_id and WooCommerce _purchase_note (confirmed on dev36)
- Fields are private unless registered with show_in_rest => true; protected (underscore) and credential-like keys (token, secret, password, api key, private key, credential, salt, nonce) are never exposed
- Zone A list path no longer returns whole rows when nothing is public, and filters / orderby accept public columns only
- Version 1.1.1; CHANGELOG, readme
- Verify: unit 690 (+3), integration 525 (+3 private-column tests, RED on 1.1.0), live suite rest 2/2 (RED on 1.1.0), all live 49/49, phpcs 0, stan OK

tests/live/README.md

@@ -40,6 +40,7 @@ Exit code 0 when every test passed, 1 otherwise. Output per test:
 | `serialized` | array meta values are stored serialized in flat tables, never "Array" |
 | `resync` | dual_write / shadow_read: flat follows native after every write (4 entities × 2 modes: update, same value, delete, refused writes, stale flat, key rename by meta_id) |
 | `router` | a routed WP_Query returns the same ids, in order, as native (OR, several post types, untyped numeric compares, named orderby, LIKE, keys of two groups, NOT EXISTS with the status/date copy route, meta orderby: HivePress sort shape, named clause, meta_key + meta_value_num); routed SQL has no GROUP BY |
+| `rest` | anonymous GET of the public listings endpoints returns no protected or credential-like field (1.1.1) |
 | `zero_side_effect` | zone tables that were never created are never queried on save / delete |
 
 ## Tools (`tools/`)

tests/live/suites/rest.php

@@ -0,0 +1,76 @@
+<?php
+/**
+ * Suite: the public listings endpoints never return private fields to anonymous users.
+ *
+ * Bug (dev36, 2026-09-26, fixed in 1.1.1): GET /wpdo/v1/listings/{id} is public and
+ * returned every registered hot / cold field, because show_in_rest defaulted to true —
+ * e.g. the infocards IG token fields on hp_vendor and WooCommerce's _purchase_note.
+ *
+ * @package WP_Data_Optimizer
+ */
+
+declare(strict_types=1);
+
+/**
+ * GET a wpdo REST route as an anonymous visitor.
+ *
+ * @param string               $route  Route, e.g. /wpdo/v1/listings/12.
+ * @param array<string, mixed> $params Query parameters.
+ * @return array<int|string, mixed> Response data.
+ */
+function tmdo_live_rest_anonymous( string $route, array $params = array() ): array {
+	$user    = get_current_user_id();
+	$request = new WP_REST_Request( 'GET', $route );
+	$request->set_query_params( $params );
+	wp_set_current_user( 0 );
+	try {
+		$response = rest_do_request( $request );
+	} finally {
+		wp_set_current_user( $user );
+	}
+	tmdo_live_assert_same( 200, $response->get_status(), "GET {$route}" );
+	return (array) $response->get_data();
+}
+
+/**
+ * Keys that must never reach an anonymous visitor.
+ *
+ * @return string[]
+ */
+function tmdo_live_rest_private_keys(): array {
+	return array( 'tmeetic_ig_access_token_enc', 'tmeetic_ig_token_expiry', 'tmeetic_ig_user_id', '_purchase_note' );
+}
+
+TMDO_Live::test(
+	'GET /wpdo/v1/listings/{id} returns no private field to an anonymous visitor',
+	static function () {
+		$checked = 0;
+		foreach ( array( 'hp_vendor', 'product' ) as $post_type ) {
+			$ids = get_posts( array( 'post_type' => $post_type, 'post_status' => 'publish', 'numberposts' => 1, 'fields' => 'ids' ) );
+			if ( ! $ids ) {
+				continue;
+			}
+			$data = tmdo_live_rest_anonymous( '/wpdo/v1/listings/' . (int) $ids[0] );
+			tmdo_live_assert_same( array(), array_values( array_intersect( tmdo_live_rest_private_keys(), array_keys( $data ) ) ), "{$post_type} #{$ids[0]} private keys" );
+			tmdo_live_assert_same( array(), array_values( preg_grep( '/^_|token|secret|passw|api_?key/i', array_keys( $data ) ) ), "{$post_type} #{$ids[0]} protected / credential-like keys" );
+			++$checked;
+		}
+		if ( 0 === $checked ) {
+			throw new TMDO_Live_Skip( 'no published hp_vendor or product on this site' );
+		}
+	}
+);
+
+TMDO_Live::test(
+	'GET /wpdo/v1/listings returns no private field to an anonymous visitor',
+	static function () {
+		foreach ( array( 'hp_vendor', 'product', 'hp_listing' ) as $post_type ) {
+			if ( ! post_type_exists( $post_type ) ) {
+				continue;
+			}
+			foreach ( tmdo_live_rest_anonymous( '/wpdo/v1/listings', array( 'post_type' => $post_type, 'per_page' => 5 ) ) as $item ) {
+				tmdo_live_assert_same( array(), array_values( preg_grep( '/^_|token|secret|passw|api_?key/i', array_keys( (array) $item ) ) ), "{$post_type} list item keys" );
+			}
+		}
+	}
+);