fix(critical): filter draft posts on production — add explicit _status:published check

lib/blog.ts

@@ -60,13 +60,15 @@ export async function getPostBySlug(slug: string, locale: string): Promise<PostM
   try {
     const payload = await getPayload({ config: configPromise });
 
+    const isDev = process.env.NODE_ENV === 'development';
     const { docs } = await payload.find({
       collection: 'posts',
       where: {
         slug: { equals: slug },
         locale: { equals: locale },
+        ...(!isDev ? { _status: { equals: 'published' } } : {}),
       },
-      draft: process.env.NODE_ENV === 'development',
+      draft: isDev,
       limit: 1,
     });
 
@@ -107,16 +109,17 @@ export async function getPostBySlug(slug: string, locale: string): Promise<PostM
 export async function getAllPosts(locale: string): Promise<PostMdx[]> {
   try {
     const payload = await getPayload({ config: configPromise });
-    // Query only published posts (access checks applied automatically by Payload!)
+    const isDev = process.env.NODE_ENV === 'development';
     const { docs } = await payload.find({
       collection: 'posts',
       where: {
         locale: {
           equals: locale,
         },
+        ...(!isDev ? { _status: { equals: 'published' } } : {}),
       },
       sort: '-date',
-      draft: process.env.NODE_ENV === 'development', // Includes Drafts if running locally
+      draft: isDev,
       limit: 100,
     });