fix(2meet-data-optimizer): treat contact and address keys as private in the public REST filter

- rest_exposable() also withholds keys named like an email, phone, address or
  IP, even when a field declares show_in_rest (defence in depth)
- Verify: RestApiTest (private and look-alike public keys), unit 701,
  integration 577, phpcs, stan; dev36 live rest suite
- PR: PR-096

includes/class-tmdo-schema-registry.php

@@ -282,7 +282,8 @@ class TMDO_Schema_Registry {
 	 * Whether a field may appear in the public listings endpoints: declared
 	 * show_in_rest, not a protected meta key (leading underscore — WordPress
 	 * hides those from public output, e.g. _purchase_note), and not named like a
-	 * credential (tokens, secrets, passwords, API keys), whatever it declares.
+	 * credential (tokens, secrets, passwords, API keys) or a contact / location
+	 * detail (email, phone, address, IP), whatever it declares.
 	 *
 	 * @param array<string, mixed> $field Registered field.
 	 * @return bool
@@ -291,7 +292,9 @@ class TMDO_Schema_Registry {
 		$key = (string) ( $field['meta_key'] ?? '' );
 		return ! empty( $field['show_in_rest'] )
 			&& 0 !== strpos( $key, '_' )
-			&& 1 !== preg_match( '/token|secret|passw|api_?key|private_?key|credential|salt|nonce/i', $key . ' ' . ( $field['column'] ?? '' ) );
+			&& 1 !== preg_match( '/token|secret|passw|api_?key|private_?key|credential|salt|nonce/i', $key . ' ' . ( $field['column'] ?? '' ) )
+			// Contact and location details (2.3 PR-096): private even when declared public.
+			&& 1 !== preg_match( '/e_?mail|phone|address|(^|_)ip(_|$|\s)/i', $key . ' ' . ( $field['column'] ?? '' ) );
 	}
 
 	/**