feat(ext-data): add unified Data gateway; mcp: derive roles claim from OIDC

Data/RepositoryFactory/HibernateData give applications one cached,
stateless entry point for repositories per entity type instead of
per-request instantiation, with write()/afterCommit() replacing manual
transaction+reload choreography.

McpConfig.rolesClaimPath is removed - MCP now derives the claim path
from OidcMiddleware.rolesClaimPath() so applications never duplicate
the roles-claim config between OIDC and MCP. McpPackageScanner is
rebuilt on the shared PackageScanner.discover(packageName) primitive,
doing only McpTool/McpResource/McpPrompt classification itself.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

flash-extensions/flash-ext-oidc/src/main/java/dev/relism/flash/ext/oidc/OidcMiddleware.java

@@ -60,6 +60,9 @@ public class OidcMiddleware {
 
     // -- Public API -----------------------------------------------------------
 
+    /** The single configured claim path used by every transport for role checks. */
+    public String rolesClaimPath() { return config.rolesClaimPath(); }
+
     /**
      * Validates the bearer token or session cookie. Browser clients are redirected
      * to the login page on failure; API clients receive 401.