feat(ext-data): add unified Data gateway; mcp: derive roles claim from OIDC

Data/RepositoryFactory/HibernateData give applications one cached,
stateless entry point for repositories per entity type instead of
per-request instantiation, with write()/afterCommit() replacing manual
transaction+reload choreography.

McpConfig.rolesClaimPath is removed - MCP now derives the claim path
from OidcMiddleware.rolesClaimPath() so applications never duplicate
the roles-claim config between OIDC and MCP. McpPackageScanner is
rebuilt on the shared PackageScanner.discover(packageName) primitive,
doing only McpTool/McpResource/McpPrompt classification itself.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

flash-extensions/flash-ext-data-hibernate/src/main/java/dev/relism/flash/ext/data/hibernate/HibernateData.java

@@ -0,0 +1,25 @@
+package dev.relism.flash.ext.data.hibernate;
+
+import dev.relism.flash.ext.data.core.Data;
+import dev.relism.flash.ext.data.core.Repository;
+import dev.relism.flash.ext.data.core.RepositoryFactory;
+import dev.relism.flash.ext.data.core.Tx;
+import dev.relism.flash.ext.data.core.TxManager;
+import java.io.Serializable;
+
+/** Hibernate-backed {@link Data} factory. */
+public final class HibernateData {
+    private HibernateData() {}
+
+    private static final RepositoryFactory REPOSITORIES = new RepositoryFactory() {
+        @Override
+        public <T, ID extends Serializable> Repository<T, ID> create(Tx tx, Class<T> type) {
+            return new HibernateRepository<T, ID>(tx, type) {};
+        }
+    };
+
+    public static Data create(TxManager manager) {
+        Tx tx = new Tx(manager);
+        return new Data(tx, REPOSITORIES);
+    }
+}

flash-extensions/flash-ext-data-hibernate/src/main/java/dev/relism/flash/ext/data/hibernate/HibernateTxManager.java

@@ -114,18 +114,20 @@ public class HibernateTxManager implements TxManager {
             cleanupIfIdle();
             return;
         }
+        TxOutcome outcome;
         try {
             if (s.isRollbackOnly() && s.session().getTransaction().isActive()) {
                 s.session().getTransaction().rollback();
-                ResourceRegistry.fireSynchronizations(TxOutcome.ROLLED_BACK);
+                outcome = TxOutcome.ROLLED_BACK;
             } else {
                 s.session().getTransaction().commit();
-                ResourceRegistry.fireSynchronizations(TxOutcome.COMMITTED);
+                outcome = TxOutcome.COMMITTED;
             }
         } finally {
             cleanupAndResume(s);
             cleanupIfIdle();
         }
+        ResourceRegistry.fireSynchronizations(outcome);
     }
 
     @Override