fix: merge mandatory filters and add loaded-model Get guard

[Upd4ting]

Summary

Implements Upd4ting's approved upstream changes for native invoice list/get scoping in cms-saas. The cms-saas wrappers remain unchanged until the upstream changes merge and are released.

Companion CMS integration: https://github.com/AntelopeJS/cms/pull/359 (draft, blocked on publishing this API).

• Parameters.ExtractFilters combines request filters with mandatory WithOptions(..., { filters }) filters. Mandatory field keys win the whole tuple. Returned maps and tuples are fresh.
• ExtractGeneric runs the native filter extractor even when route options contain filters. All other option precedence, conversion, and parameter behavior stays unchanged.
• DefaultRoutes.WithGetGuard(guard) creates the standard Get route with an awaited callback (ctx, current, params). It preserves controller this, forwards the request context, and receives the loaded/unlocked model before readable-field selection and response transformations. Throwing preserves the HTTP error; missing rows remain 404 without calling the guard. Treat current as read-only.

The Get pipeline remains one query with existing joined/computed/foreign handling, fromDatabase modifiers, unlock, ReadProperties and internal-field cleanup. No mutation hooks or universal read-scope abstraction.

Compatibility / boundaries

Behavior change: previously setting options.filters (even {}) suppressed all request filters in Parameters.List. Additional client filters now narrow the mandatory scope; same-field client filters cannot replace the mandatory tuple. Code relying on suppressing client filters must adapt. Direct ExtractFilters callers now also receive mandatory route filters. Nested WithOptions calls retain their existing shallow option composition; this change concerns route options versus request filters, not deep merging route configurations.

Filters still require registered filter metadata to affect queries. Get still ignores filters: its new guard is separate. Explicit-ID exports are not protected by this Get hook, and no export behavior changes here.

CMS list/select/count use Parameters.List; batch count directly uses ExtractFilters on a per-query context preserving route metadata. Both extraction paths now honor mandatory filters without CMS duplicating merge logic. Select's existing pluckMode: "select" envelope remains untouched.

Verification

• pnpm test: 96 passing, including new mandatory coexistence/conflicts/empty/absent options/ordinary precedence/repeated-request isolation tests, and HTTP Get guard tests for hidden fields, transforms, no-guard parity, 404/403 and missing rows. Existing modifier/access/foreign/joined/computed suites pass.
• pnpm lint: passes.
• pnpm pack --out /tmp/companion-data-api.tgz: passes (includes TypeScript build).
• CMS tested against this local build: 552 passing, including authorization → one load → guard → transformation → presence, denial short-circuiting and no-guard behavior. CMS packed consumer check with this local tarball: 116 entrypoints, Node and Node16 TypeScript consumers pass.

Merge/release ordering

Merge and publish this companion first. Then update the draft CMS PR's dependency minimum and lockfile to the actual published version, rerun checks without local overrides, and merge/release CMS. Only then remove cms-saas wrappers. No version is invented or bumped here, no release is requested, and interface-data-api 0.1.8 does not provide this hook.