feat(acp): SessionService.Create issues system MCP token in tx

- InTx wraps InsertSession + IssueSystemTokenWithTx (spec §6.1 atomic guarantee)
- Tx failure -> releaseOnFailure (worktree rollback)
- Spawn called with extraEnv = ACW_MCP_TOKEN + ACW_MCP_URL
- Spawn failure -> RevokeBySession (idempotent) + releaseOnFailure
- app.go SessionService construction updated with mcpTokens + config
- Unit tests: token issuance happy path + rollback on token failure

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/app/acp_integration_test.go

@@ -185,6 +185,7 @@ func newACPIntegrationSuite(t *testing.T) *acpIntegrationSuite {
 	sessSvc := acp.NewSessionService(
 		acpRepo, wsStub, nil, nil, paStub, sup, auditRec,
 		acp.SessionServiceConfig{MaxActiveGlobal: 20, MaxActivePerUser: 3},
+		nil, // mcpTokens — not exercised by integration tests
 	)
 
 	r := chi.NewRouter()