fix(mcp): code review I2 — admin expires_at must be future + Part 3 tx TODO + scope JSON round-trip tests

- IssueAdmin now rejects past/now ExpiresAt with CodeMcpTokenExpiresRequired
- TestIssueAdmin_ExpiresMustBeFuture covers the new path
- IssueSystemToken doc comment notes pgRepo currently ignores ctx tx; Part 3
  must add Repository.WithTx for true same-transaction guarantee with
  acp_sessions (spec §6.1)
- New scope_test.go (whitebox) verifies JSON round-trip preserves nil-vs-empty
  semantics on Tools / ProjectIDs and exercises AllowsTool / AllowsProject
  edges that Authenticate / future tool gating depend on

internal/mcp/token_service_test.go

@@ -196,6 +196,21 @@ func TestIssueAdmin_ExpiresRequired(t *testing.T) {
 	assert.Equal(t, errs.CodeMcpTokenExpiresRequired, ae.Code)
 }
 
+func TestIssueAdmin_ExpiresMustBeFuture(t *testing.T) {
+	t.Parallel()
+	svc := mcp.NewTokenService(newFakeRepo(), &fakeAudit{})
+
+	_, err := svc.IssueAdmin(context.Background(), mcp.IssueAdminInput{
+		UserID:    uuid.New(),
+		Name:      "x",
+		ExpiresAt: time.Now().Add(-time.Hour), // past
+		CreatedBy: uuid.New(),
+	})
+	ae, ok := errs.As(err)
+	require.True(t, ok)
+	assert.Equal(t, errs.CodeMcpTokenExpiresRequired, ae.Code)
+}
+
 func TestIssueSystemToken_Defaults(t *testing.T) {
 	t.Parallel()
 	repo := newFakeRepo()