fix: reveal plaintext service token on issue/rotate (HOTFIX-001)

- render_service_token_result no longer masks the token field; plaintext
  tokens are SHA-256 hashed in DB and irrecoverable once lost, so issue/
  rotate must reveal them once at issuance (matches interface-contract.md)
- Remove now-unused _mask_payload helper; keep mask_token_text for the
  auxiliary masked_token identifier line
- Add one-time reveal warning to issue/rotate table output
- 3 regression tests: JSON plaintext assertion, render unit test, table warning
- Hotfix Exception Path record: docs/hotfixes/hotfix-001
- Total tests: 369 -> 371 passed

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/cli/commands/service_tokens.py

@@ -89,6 +89,7 @@ def issue_service_token(
 
     if ctx.obj.output_format != "json":
         ctx.obj.console.print(f"masked_token: {mask_token_text(issued.token)}")
+        ctx.obj.console.print("[yellow]⚠  이 토큰은 다시 표시되지 않습니다. 지금 복사해 안전한 곳에 저장하세요.[/yellow]")
 
 
 @token_app.command("rotate")
@@ -114,6 +115,7 @@ def rotate_service_token(
 
     if ctx.obj.output_format != "json":
         ctx.obj.console.print(f"masked_token: {mask_token_text(issued.token)}")
+        ctx.obj.console.print("[yellow]⚠  이 토큰은 다시 표시되지 않습니다. 지금 복사해 안전한 곳에 저장하세요.[/yellow]")
 
 
 @token_app.command("rebind")