Keep locked passworded forums out of Recent Topics

[avandenberghe]

Closes #193.

Problem
get_forum_list() built the forum list from f_read / f_list_topics only. phpBB grants f_read on a passworded forum regardless of the password, so a forum the user hadn't unlocked was still included. Its topic titles, last-post subjects and authors showed in the Recent Topics block on the index, on viewforum and on /app.php/rt, even though the board itself hides them until the password is entered.

Fix
core/recenttopics.php: after the permission pass, drop the forums returned by $this->user->get_passworded_forums(). That's the same check the index, viewforum, search and feeds use. It runs before the forum_recent_topics query, so the single-forum path (which skips that query) is covered too.

Tests

• New tests/core/forum_list_test.php, documented in tests/tests.md:
  • a locked forum is excluded
  • a locked forum is excluded when only one forum remains
  • forums without a locked password are kept
• The first two failed before the fix and pass after it.
• Unit suite: 44 tests, 0 failures, run locally against the checkout. The functional tests run in CI.

Checked on the local board as a guest (temporary password on a forum, removed afterwards):

	pbTech Style topic, index	pbTech Style topic, /app.php/rt
no password	shown	shown
passworded, before fix	shown (leak)	shown (leak)
passworded, after fix	hidden; other 16 topics still listed	hidden; other 16 topics still listed
password removed, after fix	shown	shown

No changelog entry or version bump: per this repo's convention, those go in the release commit.

🤖 Generated with Claude Code