Implement registration-time validation for fields and groups

Split out from the coding-standards cleanup (#147), which removed the commented-out validation logic and its `// TODO` notes from `_validate_metadata_group()` and `_validate_metadata_field()` so the intent could be tracked here. Both methods are currently stubs that always return `true`.

**Intended group validation** (`_validate_metadata_group`)
- Reject an empty group slug.
- Reject a group already registered for the object type.
- Reject a restricted group slug (see #152).

**Intended field validation** (`_validate_metadata_field`)
- Reject an empty field slug, with the error "You entered an empty slug name for this field!".
- Reject a field already registered for the group/object type, with an error explaining it may be a duplicate registration or needs a different slug.
- Reject a restricted field slug (see #152).
- When no `display_callback` is defined, surface an `admin_notices` error and fall back to rendering a text field.

The original TODO also asked whether validation should run only when a debug constant is enabled, to avoid overhead in production.

Implementing this will use the `$group`/`$object_type` and `$field`/`$group_slug`/`$object_types` parameters that are currently unused on those methods. Related but distinct: runtime validation of required fields is tracked in #23.

Start by reading _validate_metadata_group() and _validate_metadata_field(), then trace their registration call sites and the currently unused parameters. Review the restricted-slug work in #152 and the distinction from runtime validation in #23. Done means all listed duplicate, empty, restricted-slug, and missing-display-callback cases are handled, with the production debug-overhead decision resolved.

Written by the indexing model from the issue text.