chore(2meet-data-optimizer): address the 2.1 audit notes

- The four public REST routes say why they are public (viewable posts only, show_in_rest fields only, per_page cap, one view per IP per post per hour).
- Admin ternary echoes of literal strings are escaped for their context: esc_attr() in attributes, esc_html() for text; the object-cache badge is an if/else and aria-current is always printed ("false" off the current tab).
- Exceptions in the migration engine and the health cron go to TMDO_Logger instead of error_log().
- Verify: audit greps (ternary echoes 23 → 0, error_log outside the logger 0); dev36 renders 8 admin tabs with the change, no PHP notice, one aria-current="page" each.
- PR: PR-078

includes/class-tmdo-rest-api.php

@@ -37,6 +37,8 @@ class TMDO_REST_API {
 			array(
 				'methods'             => WP_REST_Server::READABLE,
 				'callback'            => array( $this, 'get_listings' ),
+				// Public by design: viewable post types and published posts only, fields
+				// declared show_in_rest only (1.1.1), per_page capped (wpdo_rest_max_per_page).
 				'permission_callback' => '__return_true',
 				'args'                => $this->listings_args(),
 			)
@@ -48,6 +50,8 @@ class TMDO_REST_API {
 			array(
 				'methods'             => WP_REST_Server::READABLE,
 				'callback'            => array( $this, 'get_listing' ),
+				// Public by design: the post must be viewable to the request (assert_post_viewable_or_error:
+				// publicly viewable or read_post); fields declared show_in_rest only (1.1.1).
 				'permission_callback' => '__return_true',
 				'args'                => array(
 					'id' => array(
@@ -65,6 +69,7 @@ class TMDO_REST_API {
 			array(
 				'methods'             => WP_REST_Server::READABLE,
 				'callback'            => array( $this, 'get_stats' ),
+				// Public by design: view / engagement counters of a post viewable to the request.
 				'permission_callback' => '__return_true',
 				'args'                => array(
 					'id' => array(
@@ -82,6 +87,8 @@ class TMDO_REST_API {
 			array(
 				'methods'             => WP_REST_Server::CREATABLE,
 				'callback'            => array( $this, 'post_view' ),
+				// Public by design: anonymous visitors count views; viewable posts only, one view
+				// per IP per post per hour (rate limited).
 				'permission_callback' => '__return_true',
 				'args'                => array(
 					'id' => array(