fix: dismiss stale session-timeout flash on auto-login, resolve PHPStan and i18n issues

- Add Flash::dismissByKey() to clear flash messages by key+scope
- Dismiss 'session_timeout' flash after successful remember-me auto-login
  so the message doesn't persist through manual logout
- Suppress PHPStan false positives for dynamically defined MINTY_ALLOW_OUTPUT
- Remove unnecessary ?? [] fallbacks on preg_match_all results in tests
- Add missing i18n key 'No active roles are configured yet.'

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lib/Support/Flash.php

@@ -95,6 +95,30 @@ class Flash
         }
     }
 
+    /**
+     * Remove all flash messages matching a given key (and optionally scope).
+     */
+    public static function dismissByKey(string $key, ?string $scope = null): void
+    {
+        self::ensureSession();
+        $messages = $_SESSION[self::SESSION_KEY] ?? [];
+        $messages = array_values(array_filter($messages, function ($message) use ($key, $scope) {
+            if (($message['key'] ?? null) !== $key) {
+                return true;
+            }
+            if ($scope !== null && ($message['scope'] ?? null) !== $scope) {
+                return true;
+            }
+            return false;
+        }));
+
+        if ($messages) {
+            $_SESSION[self::SESSION_KEY] = $messages;
+        } else {
+            unset($_SESSION[self::SESSION_KEY]);
+        }
+    }
+
     // Prevents messages from being cleared on the next render — useful when a redirect chain crosses multiple pages.
     public static function keep(int $times = 1)
     {