feat(12.1-02): writable foreign keys, locked relation options, invisible columns

- FieldRelationContract.WritableForeignKey makes a belongsTo field over a
  protected foreign key writable; the protected key list is unchanged
- cabana.RelationLockProvider names related ids an administrator may not add
  or remove: options and labels carry locked, and a create or update that
  changes the locked subset is 403 before any row is written
- columns.yaml invisible keeps a column searchable and out of the rows
- a controller implementing pact.FilterOptions serves a scope filter's
  choices before the model
- SPA: locked chips and options in RelationField, DataTable skips invisible
  columns
- README, docs, OpenAPI document, TS types and dist updated

modules/phrasebook/backend/lang/en/lang.yaml

@@ -76,6 +76,8 @@ form:
   deleting: Deleting…
   add: Add
   remove_item: "Remove: :name"
+  locked_item: "Locked: :name"
+  locked_note: Items marked with a lock need an additional permission to change.
   add_item: Add…
   select_placeholder: Select…
   loading_options: Loading…