fix(2meet-data-optimizer): drop router query vars a caller passed in

- pre_get_posts clears wpdo_post_clauses / _sort / _copy_route / _count_sql
  before anything else: new WP_Query( array( … ) ) could preset them
- posts_orderby whitelists the copy route's direction
- Found in the 2.4 security review (Low L2; not reachable from URLs)
- Verify: PostQueryRouterCopyTest (1 new); integration 604, unit 704, phpcs 0
- PR: PR-132

includes/query/class-tmdo-post-query-router.php

@@ -138,6 +138,11 @@ class TMDO_Post_Query_Router {
 	 * @return void
 	 */
 	public function pre_get_posts( \WP_Query $query ): void {
+		// The router's query vars are its own: drop any a caller passed in.
+		foreach ( array( self::QUERY_VAR, self::SORT_VAR, self::COPY_VAR, self::COUNT_VAR ) as $var ) {
+			$query->set( $var, '' );
+		}
+
 		// Mode gate: only run when post mode is reads_from_flat.
 		if ( ! self::is_router_active() ) {
 			return;
@@ -389,7 +394,7 @@ class TMDO_Post_Query_Router {
 		if ( empty( $copy ) ) {
 			return $orderby;
 		}
-		return '`' . self::table_alias( $copy['post_type'], $copy['group'] ) . '`.`post_date` ' . $copy['order'];
+		return '`' . self::table_alias( $copy['post_type'], $copy['group'] ) . '`.`post_date` ' . ( 'ASC' === $copy['order'] ? 'ASC' : 'DESC' );
 	}
 
 	/**