feat: clean up own data on deactivation and uninstall

Deactivation now clears the endpoint-check transient and the cached rewrite
rules (forcing WordPress to regenerate them without this plugin's routes on
the next request) and activation asks mcp-oauth to re-flush its own rules.
uninstall.php removes all own options/transient/cron/table across every site
of a network, delegating to the new self-contained LIT\MCP\Uninstaller class
so it works without the plugin's autoloader and is unit-testable on its own.
mcp-oauth's data (JWT secret, rewrite marker, refresh-token meta, application
passwords) is left untouched, as is every post/attachment/revision.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

uninstall.php

@@ -0,0 +1,27 @@
+<?php
+
+/**
+ * Uninstall WP-LIT-MCP: removes its own data only, on every site of a network.
+ *
+ * Removed: options lit_mcp_allowed_roles, lit_mcp_exposure, lit_mcp_limits, lit_mcp_db_version,
+ * transient lit_mcp_endpoint_check, cron hook lit_mcp_log_cleanup, table {prefix}lit_mcp_log.
+ *
+ * Kept on purpose: data of the bundled wp-media/mcp-oauth library (option mcp_jwt_secret,
+ * option wpmedia_mcp_oauth_rewrite_version, user meta mcp_refresh_jti_*, application passwords
+ * of connected clients). The library may be used by other plugins on this site; see readme.txt.
+ * Posts, attachments and revisions are never touched.
+ *
+ * The cleanup logic lives in src/Uninstaller.php, required directly below by path rather
+ * than through the Composer/Jetpack autoloader: WordPress core runs uninstall.php standalone
+ * without loading the plugin's main file, so that autoloader is not guaranteed to have run.
+ * tests/Unit/UninstallerTest.php unit-tests that class; tests/Unit/UninstallTest.php exercises
+ * this script's wiring to it.
+ */
+
+declare(strict_types=1);
+
+defined('WP_UNINSTALL_PLUGIN') || exit;
+
+require_once __DIR__ . '/src/Uninstaller.php';
+
+\LIT\MCP\Uninstaller::run();