fix(session): age flash values at the start of the request

[osbre]

Closes #1734. Addresses #210.

Problem

A flash value is meant to live for one request and then go away.

The old logic removed a flash value once it was read. But the cleanup happened before the view was rendered - and views are often where the value is actually read (for example, the default form and input components). By then it was too late: the value was already saved back into the session, so it showed up again on the next request.

And if a flash value was never read, it was never removed at all.

Fix

Instead of expiring flash values at the end of the request, expire them at the start:

• values flashed on the previous request are removed;
• values flashed since then are marked to go on the next request.

Reads no longer affect this, so a flash value stays readable for the whole request, including whilst the view renders, and is reliably gone on the next one.

The session is still saved right away. This is a bit different from the idea in #210 (removing once the response is sent): expiring at the start of the next request gives the same result without deferring any work, and doesn't change the public API.

Notes

Three tests checked the old read-based timing (flash() then a single cleanup()); they now check the two-request lifecycle. A new test covers a flash value expiring even when it's never read.

[github-actions]

Benchmark Results

Comparison of fix/flash-lifecycle against 3.x (8838c1ecb7bf585b2e176d1163cf643c22999b82).

Open to see the benchmark results

Benchmark	Set	Mem. Peak	Time	Variability
ContainerBench(benchRegisterClosureSingleton)	-	6.417mb 0.00%	1.846μs +5.01%	±2.48% +25.37%
ViewRenderBench(benchExpressions)	-	24.544mb 0.00%	533.039μs -5.30%	±3.13% +46.62%

_{Generated by phpbench against commit 27c5ee6}