fix: chat token/secret visibility bug + ACP token field (studio#132/#136)

[brettchien]

Summary

Two things Brett caught live-testing the wizard (screenshot: "Bot token" + "Channel secret" both showing with Chat platform set to "— none —").

Bug: hidden chat token/secret fields stayed visible

.compose-form label { display: flex; ... } has higher specificity ((0,1,1)) than the UA stylesheet's [hidden] { display: none } ((0,1,0)), so toggling .hidden on #deploy-chat-token-wrap/#deploy-chat-secret-wrap (both <label> elements inside .compose-form) did nothing. Same CSS gotcha already hit once in studio#83's implementation — missed again here since this environment can't render the app to catch it (only live testing does). Added .compose-form label[hidden] { display: none } to force the override, plus the identical fix for .deploy-identity label[hidden] (the k8s "new namespace" field has the same latent bug — not confirmed live, but same root cause, fixed proactively rather than waiting to get caught separately).

Feature: ACP token field + Generate button

Brett: "when ACP is enabled, need a field for acp token, and we should provide a token generator button." Previously the ACP auth key was always silently auto-generated server-side (uuid v4) with no way for the operator to see or choose it ahead of deploy.

• console: new "ACP token" field + Generate button (client-side crypto.randomUUID(), same shape the server generates), visible only while Enable ACP is checked+enabled — reuses the same show/hide-on-toggle pattern the chat platform fields already use, via a new applyAcpMode() helper.
• studio-cp: AgentWizardInput gained acp_token: Option<String>. provision_acp_auth_secret/provision_acp_auth_k8s_secret now take a token: Option<&str> — use it if the caller supplied one, else generate as before (backward compatible: the compose-library path still always passes None). build_default_manifest/build_default_k8s_manifest thread it through; all 4 call sites updated.
• oab-mcp: deploy_provision_agent's schema gained acp_token (optional).
• src-tauri: bridge command threads the new param through.

Verification

• npm run typecheck clean, npm test 100/100 passing, npm run build succeeds.
• Rust side not locally compiled — same pre-existing aws-sdk-ec2 OOM limitation as every other Rust change this week.
• Worth Brett re-testing the exact scenario from the screenshot (Chat platform = none) plus the new ACP token field/Generate button once merged.

Note: independent of #136 (local-config-folder-write PR, still open) — touches the same invoke(...) args block in deploy.ts, so whichever merges second may need a quick rebase.

🤖 Generated with Claude Code