fix(session): initialize $data property with default empty array

[woprrr]

Summary

• Initialize Session::$data with = [] to prevent TypeError when the property is accessed before initialization on a newly created session
• Replace isset($this->data) check in readData() with an explicit $loaded flag to preserve lazy loading from the session store
• Set $loaded = true in clear() and hydrate() to maintain consistent state

Fixes #273

Test plan

• All 28 existing SessionTest tests pass
• PHPStan level 6 with no errors
• PHP-CS-Fixer with no violations
• testSaveBeforeReadInitializesData confirms save() on a fresh session works
• testSessionLoadsDataFromStoreOnConstruction confirms lazy loading still works