feat(12.1-02): writable foreign keys, locked relation options, invisible columns

- FieldRelationContract.WritableForeignKey makes a belongsTo field over a
  protected foreign key writable; the protected key list is unchanged
- cabana.RelationLockProvider names related ids an administrator may not add
  or remove: options and labels carry locked, and a create or update that
  changes the locked subset is 403 before any row is written
- columns.yaml invisible keeps a column searchable and out of the rows
- a controller implementing pact.FilterOptions serves a scope filter's
  choices before the model
- SPA: locked chips and options in RelationField, DataTable skips invisible
  columns
- README, docs, OpenAPI document, TS types and dist updated

modules/cabana/crud.go

@@ -651,6 +651,11 @@ func (s CRUDService) save(ctx context.Context, cc *CompiledController, id any, i
 		if err := checkRelationScope(ctx, tx, cc, relations); err != nil {
 			return err
 		}
+		// D-07: a change to related ids the controller locks for this
+		// administrator is refused before any row is written.
+		if err := checkRelationLocks(ctx, tx, cc, target, relations); err != nil {
+			return err
+		}
 		if err := assignBelongsTo(cc, target, relations); err != nil {
 			return err
 		}