feat(acp): Supervisor.onExit revokes system MCP token (spec §6.3)

- mcpTokens dep added to Supervisor; nil-safe (test fixtures may skip)
- RevokeBySession called after audit Record in onExit
- app.go wires mcpTokenSvc (was nil placeholder)
- Integration test: fakeSupMCPTokens verifies onExit calls RevokeBySession

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/app/acp_integration_test.go

@@ -175,7 +175,7 @@ func newACPIntegrationSuite(t *testing.T) *acpIntegrationSuite {
 		EventTruncateField: 4096,
 		ShutdownGrace:      5 * time.Second,
 	}
-	sup := acp.NewSupervisor(acpRepo, auditRec, disp, nil, nil, enc, supCfg, log)
+	sup := acp.NewSupervisor(acpRepo, auditRec, disp, nil, nil, nil, enc, supCfg, log)
 
 	// Minimal stubs for SessionService dependencies — sufficient for branch=main
 	// path (no wtSvc / wsRepo calls) and tests that exercise quota/conflict logic.