feat(acp): SessionService.Create issues system MCP token in tx

- InTx wraps InsertSession + IssueSystemTokenWithTx (spec §6.1 atomic guarantee)
- Tx failure -> releaseOnFailure (worktree rollback)
- Spawn called with extraEnv = ACW_MCP_TOKEN + ACW_MCP_URL
- Spawn failure -> RevokeBySession (idempotent) + releaseOnFailure
- app.go SessionService construction updated with mcpTokens + config
- Unit tests: token issuance happy path + rollback on token failure

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/acp/handler_e2e_test.go

@@ -152,6 +152,7 @@ func TestHandler_Session_CreateAndWS_E2E(t *testing.T) {
 		repo, wsStub, nil, nil, paStub, sup,
 		audit.NewPostgresRecorder(pool),
 		acp.SessionServiceConfig{MaxActiveGlobal: 10, MaxActivePerUser: 5},
+		nil, // mcpTokens — not exercised by handler e2e
 	)
 
 	h := acp.NewHandler(