fix: harden WordPress content rendering

tests/functional/tests/portal.spec.ts

@@ -54,15 +54,15 @@ test("provides usable contact actions", async ({ page }) => {
   await expect(page.locator(".social-link-youtube")).toHaveCount(1);
   await expect(page.getByRole("link", { name: "Instagram" })).toHaveAttribute(
     "href",
-    "https://instagram.com/",
+    "https://instagram.com/azionelab",
   );
   await expect(page.getByRole("link", { name: "Facebook" })).toHaveAttribute(
     "href",
-    "https://facebook.com/",
+    "https://facebook.com/azionelab",
   );
   await expect(page.getByRole("link", { name: "YouTube" })).toHaveAttribute(
     "href",
-    "https://youtube.com/",
+    "https://youtube.com/@azionelab",
   );
   await expect(page.locator(".social-links .social-icon")).toHaveCount(3);
   await expect(page.locator(".contact-actions .contact-icon")).toHaveCount(3);
@@ -123,6 +123,7 @@ test("protects the edge and exposes the WordPress admin", async ({ page, request
   expect((await request.get("/wp-config.php")).status()).toBe(404);
   expect((await request.get("/wp-content/uploads/probe.php")).status()).toBe(403);
   expect((await request.get("/wp-json/wp/v2/users")).status()).toBe(404);
+  expect((await request.get("/?post_type=azl_show&name=le-cose-che-restano")).status()).toBe(404);
 
   await page.goto("/wp-admin/");
   await expect(page).toHaveURL(/\/wp-login\.php/);

tests/security/check-compose.sh

@@ -26,3 +26,8 @@ grep -q 'wp-content/(uploads|files)' /workspace/wordpress/apache-hardening.conf
     echo "Apache hardening must block PHP execution below uploads/files." >&2
     exit 1
 }
+
+grep -q "'publicly_queryable'[[:space:]]*=>[[:space:]]*false" /workspace/wordpress/mu-plugins/azionelab-content.php || {
+    echo "Structured show content must not be exposed as standalone public routes." >&2
+    exit 1
+}