Data flow analysis endpoint (forward/backward variable tracking)

## Summary
Add a data flow analysis tool that traces how values propagate through a function — forward (where does this value go?) and backward (where did this value come from?).

## Motivation
When a model tries to understand what a function does, knowing 'this parameter flows into a memcpy size argument' or 'this return value came from a network read' is extremely high-signal context. It's the kind of information that makes the difference between naming a function \ProcessData\ vs \ParseNetworkPacketHeader\.

Currently no equivalent exists in our 193 tools. starsong-consulting/GhydraMCP has \nalysis_get_dataflow\ with forward/backward direction and max_steps.

## Design Ideas
- New \@McpTool\ method in AnalysisService
- Parameters: address, variable/register, direction (forward/backward), max_steps
- Uses Ghidra's \DecompInterface\ Varnode/PcodeOp graph traversal
- Returns chain of operations showing data producers/consumers
- Self-contained: 200-300 lines of Java, no existing code changes

## Effort Estimate
Medium-High — requires understanding Ghidra's Varnode graph API, but implementation is self-contained in AnalysisService.

## References
- starsong-consulting/GhydraMCP \nalysis_get_dataflow\
- Ghidra \DecompInterface\ / \HighFunction\ / \Varnode\ APIs

[]