fix: reveal plaintext service token on issue/rotate (HOTFIX-001)

- render_service_token_result no longer masks the token field; plaintext
  tokens are SHA-256 hashed in DB and irrecoverable once lost, so issue/
  rotate must reveal them once at issuance (matches interface-contract.md)
- Remove now-unused _mask_payload helper; keep mask_token_text for the
  auxiliary masked_token identifier line
- Add one-time reveal warning to issue/rotate table output
- 3 regression tests: JSON plaintext assertion, render unit test, table warning
- Hotfix Exception Path record: docs/hotfixes/hotfix-001
- Total tests: 369 -> 371 passed

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/cli/core/output.py

@@ -14,17 +14,8 @@ def mask_token_text(raw_token: str) -> str:
     return mask_secret(raw_token, prefix=6, suffix=4)
 
 
-def _mask_payload(payload: dict[str, Any]) -> dict[str, Any]:
-    masked = dict(payload)
-    token = masked.get("token")
-    if isinstance(token, str) and token:
-        masked["token"] = mask_token_text(token)
-    return masked
-
-
 def render_service_token_result(console: Console, output_format: str, payload: Any) -> None:
+    # 발급(issue/rotate) 결과는 평문 토큰을 1회 노출한다. 평문은 hash_token(SHA-256)으로만
+    # DB에 저장되어 이후 복구가 불가능하므로, 발급 렌더링 경로에서는 마스킹하지 않는다.
     plain = payload.model_dump(mode="json") if hasattr(payload, "model_dump") else payload
-    if isinstance(plain, dict):
-        render_output(console, output_format, _mask_payload(plain))
-        return
     render_output(console, output_format, plain)