v1.50.1 — Kochab

Two silent no-op extension points, fixed. Framework-only patch — no env vars, no migrations, no API breaks.
composer update glueful/framework is sufficient (the api-skeleton ^1.50.0 constraint already permits 1.50.1).

Fixed

• ServiceProvider::mergeConfig() now actually merges extension config defaults. It delegated to a
  config.manager service that was never registered, so an extension's config/*.php defaults never reached config()
  — every first-party extension (aegis, conversa, email-notification, entrada, meilisearch, notiva,
  payvia, runiva) ran on empty/hardcoded fallbacks unless the app shipped its own copy. Now backed by the new
  ApplicationContext::mergeConfigDefaults(), which merges defaults under framework/app/env config files (app
  values win) and persists across clearConfigCache().
• LoginResponseBuildingEvent listeners now affect the login response. LoginResponseShaper::shape() dispatched
  the event but returned the original session, discarding listener mutations; it now reads $event->getResponse() back,
  so listeners can add fields (e.g. organization/department context) to the response.

Upgrade Notes

• composer update glueful/framework — nothing else required.
• Behavioral: enabled first-party extensions now receive their declared config defaults (previously ignored). Your
  config/*.php still overrides them; review those defaults if you relied on the prior behavior.

Full changelog: CHANGELOG.md · compared to 1.50.0