feat(acp): SessionService.Create issues system MCP token in tx

- InTx wraps InsertSession + IssueSystemTokenWithTx (spec §6.1 atomic guarantee)
- Tx failure -> releaseOnFailure (worktree rollback)
- Spawn called with extraEnv = ACW_MCP_TOKEN + ACW_MCP_URL
- Spawn failure -> RevokeBySession (idempotent) + releaseOnFailure
- app.go SessionService construction updated with mcpTokens + config
- Unit tests: token issuance happy path + rollback on token failure

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/app/app.go

@@ -351,7 +351,10 @@ func New(ctx context.Context, cfg *config.Config, dist embed.FS) (*App, error) {
 		acp.SessionServiceConfig{
 			MaxActiveGlobal:  cfg.Acp.MaxActiveGlobal,
 			MaxActivePerUser: cfg.Acp.MaxActivePerUser,
+			SystemTokenTTL:   cfg.MCP.SystemTokenTTL,
+			MCPPublicURL:     cfg.MCP.PublicURL,
 		},
+		mcpTokenSvc,
 	)
 	acp.NewHandler(akSvc, sessSvc, acpSup, acpRepo, userSvc, userAdminAdapter{svc: userSvc}, enc, acp.WSConfig{
 		PingInterval: cfg.Acp.WSPingInterval,