Strip empty flash data and token from session

[Naoray]

Summary

• Strip _flash from session data when both old and new are empty arrays, reducing visual noise
• Strip _token entirely from session data since it is always redacted and adds no debugging value
• Remove _flash from the data section (it was duplicated there via Session::all()) so flash info only appears in the dedicated flash key when non-empty

Closes #35

Test plan

• Verify empty flash data (_flash: { old: [], new: [] }) is stripped from session output
• Verify non-empty flash data is preserved in the flash key
• Verify _token is completely removed from session data
• Verify existing session data collection still works correctly
• All 282 tests pass

🤖 Generated with Claude Code