feat(acp): Supervisor.onExit revokes system MCP token (spec §6.3)

- mcpTokens dep added to Supervisor; nil-safe (test fixtures may skip)
- RevokeBySession called after audit Record in onExit
- app.go wires mcpTokenSvc (was nil placeholder)
- Integration test: fakeSupMCPTokens verifies onExit calls RevokeBySession

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/app/app.go

@@ -333,7 +333,7 @@ func New(ctx context.Context, cfg *config.Config, dist embed.FS) (*App, error) {
 	acpProjAccess := acpProjectAccessAdapter{wsRepo: wsRepo, projectRepo: projectRepo}
 	acpSup := acp.NewSupervisor(
 		acpRepo, auditRec, notifyDispatcher,
-		wtSvc, wsRepo, nil, enc,
+		wtSvc, wsRepo, mcpTokenSvc, enc,
 		acp.SupervisorConfig{
 			SpawnTimeout:       cfg.Acp.SpawnTimeout,
 			KillGrace:          cfg.Acp.KillGrace,