feat(12.1-02): writable foreign keys, locked relation options, invisible columns

- FieldRelationContract.WritableForeignKey makes a belongsTo field over a
  protected foreign key writable; the protected key list is unchanged
- cabana.RelationLockProvider names related ids an administrator may not add
  or remove: options and labels carry locked, and a create or update that
  changes the locked subset is 403 before any row is written
- columns.yaml invisible keeps a column searchable and out of the rows
- a controller implementing pact.FilterOptions serves a scope filter's
  choices before the model
- SPA: locked chips and options in RelationField, DataTable skips invisible
  columns
- README, docs, OpenAPI document, TS types and dist updated

modules/cabana/list_schema.go

@@ -67,6 +67,7 @@ type columnDocument struct {
 	Type       string `yaml:"type"`
 	Relation   string `yaml:"relation"`
 	Select     string `yaml:"select"`
+	Invisible  bool   `yaml:"invisible"`
 }
 
 // CompileListSchema compiles config_list.yaml and the columns.yaml it names.
@@ -265,6 +266,7 @@ func compileColumns(pluginID string, ctl pact.AdminController, fsys fs.FS, colPa
 			Type:       typ,
 			Relation:   spec.Relation,
 			Select:     spec.Select,
+			Invisible:  spec.Invisible,
 		})
 	}
 	return compiled, nil