feat(12.1-02): writable foreign keys, locked relation options, invisible columns

- FieldRelationContract.WritableForeignKey makes a belongsTo field over a
  protected foreign key writable; the protected key list is unchanged
- cabana.RelationLockProvider names related ids an administrator may not add
  or remove: options and labels carry locked, and a create or update that
  changes the locked subset is 403 before any row is written
- columns.yaml invisible keeps a column searchable and out of the rows
- a controller implementing pact.FilterOptions serves a scope filter's
  choices before the model
- SPA: locked chips and options in RelationField, DataTable skips invisible
  columns
- README, docs, OpenAPI document, TS types and dist updated

admin/tests/fixtures/roster.form-schema.json

@@ -5,6 +5,8 @@
     "fields": [
       { "name": "name", "type": "text", "label": "Name", "span": "left" },
       { "name": "email", "type": "text", "label": "Email", "span": "right" },
+      { "name": "team", "type": "relation", "label": "Team", "nameFrom": "name", "emptyOption": "No team" },
+      { "name": "tags", "type": "relation", "label": "Tags", "nameFrom": "name", "multiple": true },
       { "name": "slug", "type": "text", "label": "Slug", "preset": { "field": "name", "type": "slug" } },
       { "name": "password", "type": "password", "label": "Password", "span": "left", "context": ["create", "update"] },
       { "name": "password_confirmation", "type": "password", "label": "Repeat the password", "span": "right", "context": ["create", "update"] },

admin/tests/fixtures/roster.list-schema.json

@@ -14,7 +14,8 @@
     "assets": { "scripts": [], "styles": [] },
     "columns": [
       { "key": "name", "label": "Name", "searchable": true, "sortable": true },
-      { "key": "email", "label": "Email", "searchable": true, "sortable": true }
+      { "key": "email", "label": "Email", "searchable": true, "sortable": true, "invisible": true },
+      { "key": "slug", "label": "Slug", "searchable": false, "sortable": true }
     ],
     "filters": [],
     "rowActions": [],

admin/tests/fixtures/roster.list.json

@@ -1,8 +1,8 @@
 {
   "data": [
-    { "id": 1, "name": "Ada Lovelace", "email": "ada@example.test" },
-    { "id": 2, "name": "Bob Stone", "email": "bob@example.test" },
-    { "id": 3, "name": "Cy Young", "email": "cy@example.test" }
+    { "id": 1, "name": "Ada Lovelace", "slug": "ada-lovelace" },
+    { "id": 2, "name": "Bob Stone", "slug": "bob-stone" },
+    { "id": 3, "name": "Cy Young", "slug": "cy-young" }
   ],
   "meta": {
     "page": 1,

admin/tests/fixtures/roster.record.json

@@ -1,7 +1,7 @@
 {
-  "data": { "id": 1, "name": "Ada Lovelace", "email": "ada@example.test", "slug": "ada-lovelace", "joined_ip": "203.0.113.7", "permissions": { "legacy.code": 1, "posts.edit": 1, "reports.export": 1 } },
+  "data": { "id": 1, "name": "Ada Lovelace", "email": "ada@example.test", "team": 2, "tags": [5, 6], "slug": "ada-lovelace", "joined_ip": "203.0.113.7", "permissions": { "legacy.code": 1, "posts.edit": 1, "reports.export": 1 } },
   "meta": {
-    "labels": {},
+    "labels": { "team": [{ "value": 2, "label": "Home" }], "tags": [{ "value": 5, "label": "staff", "locked": true }, { "value": 6, "label": "news" }] },
     "actions": [
       { "name": "activate", "label": "Activate" },
       { "name": "reinstate", "label": "Reinstate", "confirm": "Lift the ban on this person?" }