feat: clean up own data on deactivation and uninstall

Deactivation now clears the endpoint-check transient and the cached rewrite
rules (forcing WordPress to regenerate them without this plugin's routes on
the next request) and activation asks mcp-oauth to re-flush its own rules.
uninstall.php removes all own options/transient/cron/table across every site
of a network, delegating to the new self-contained LIT\MCP\Uninstaller class
so it works without the plugin's autoloader and is unit-testable on its own.
mcp-oauth's data (JWT secret, rewrite marker, refresh-token meta, application
passwords) is left untouched, as is every post/attachment/revision.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Lifecycle.php

@@ -4,12 +4,15 @@ declare(strict_types=1);
 
 namespace LIT\MCP;
 
+use LIT\MCP\Admin\ConnectionStatus;
 use LIT\MCP\ChangeLog\ChangeLog;
 use LIT\MCP\ChangeLog\ChangeLogCleanup;
 use LIT\MCP\ChangeLog\ChangeLogInstaller;
+use WPMedia\MCP\OAuth\Bootstrap as OAuthBootstrap;
 
 /**
- * Activation and deactivation hooks (registered in wp-lit-mcp.php).
+ * Activation and deactivation hooks (registered in wp-lit-mcp.php). Uninstall
+ * lives in uninstall.php.
  */
 final class Lifecycle
 {
@@ -18,10 +21,20 @@ final class Lifecycle
         $log = new ChangeLog();
         (new ChangeLogInstaller($log))->install();
         (new ChangeLogCleanup($log, new Limits()))->ensureScheduled();
+
+        if (class_exists(OAuthBootstrap::class)) {
+            // mcp-oauth's public API: rewrite its /oauth and /.well-known rules on the next init.
+            OAuthBootstrap::schedule_rewrite_flush();
+        }
     }
 
     public static function deactivate(): void
     {
         wp_clear_scheduled_hook(ChangeLogCleanup::HOOK);
+        delete_transient(ConnectionStatus::ENDPOINT_TRANSIENT);
+        // WordPress regenerates the rules on the next request – without those of this now
+        // inactive plugin. Calling flush_rewrite_rules() here instead would rewrite them
+        // including our rules, because the plugin is still loaded during this request.
+        delete_option('rewrite_rules');
     }
 }

src/Uninstaller.php

@@ -0,0 +1,62 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP;
+
+/**
+ * Removes WP-LIT-MCP's own data (uninstall.php, Task 12): options, the endpoint-check
+ * transient, the log-cleanup cron hook and the change log table – on every site of a
+ * network.
+ *
+ * Deliberately self-contained (no reference to any other LIT\MCP\* class): uninstall.php
+ * is executed by WordPress core standalone, without loading the plugin's main file first,
+ * so the Composer/Jetpack autoloader is not guaranteed to have run. The option/hook/table
+ * names below are therefore duplicated from Access::OPTION, Abilities\ExposurePolicy::OPTION,
+ * Limits::OPTION, ChangeLog\ChangeLogInstaller::VERSION_OPTION, Admin\ConnectionStatus::
+ * ENDPOINT_TRANSIENT, ChangeLog\ChangeLogCleanup::HOOK and ChangeLog\ChangeLog::TABLE on
+ * purpose; tests/Unit/UninstallerTest.php and tests/Unit/UninstallTest.php keep them in
+ * sync with those constants.
+ *
+ * Never touches the bundled wp-media/mcp-oauth library's data (option mcp_jwt_secret,
+ * option wpmedia_mcp_oauth_rewrite_version, user meta mcp_refresh_jti_*, application
+ * passwords of connected clients) – that library may be shared with other plugins on
+ * this site. Never deletes posts, attachments or revisions.
+ */
+final class Uninstaller
+{
+    private const OPTIONS = ['lit_mcp_allowed_roles', 'lit_mcp_exposure', 'lit_mcp_limits', 'lit_mcp_db_version'];
+    private const TRANSIENT = 'lit_mcp_endpoint_check';
+    private const CRON_HOOK = 'lit_mcp_log_cleanup';
+    private const TABLE = 'lit_mcp_log';
+
+    public static function run(): void
+    {
+        if (! is_multisite()) {
+            self::removeSiteData();
+
+            return;
+        }
+
+        foreach (get_sites(['fields' => 'ids', 'number' => 0]) as $site_id) {
+            switch_to_blog((int) $site_id);
+            self::removeSiteData();
+            restore_current_blog();
+        }
+    }
+
+    public static function removeSiteData(): void
+    {
+        global $wpdb;
+
+        foreach (self::OPTIONS as $option) {
+            delete_option($option);
+        }
+        delete_transient(self::TRANSIENT);
+        wp_clear_scheduled_hook(self::CRON_HOOK);
+
+        $table = $wpdb->prefix . self::TABLE;
+        // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- own table name, not user input.
+        $wpdb->query("DROP TABLE IF EXISTS {$table}");
+    }
+}