Fix iris setup: embed generated token in the pairing URL/QR

interactive_setup() generated a fresh IRIS_TOKEN and saved it to .env,
but the local `token` variable was never updated, so the pairing URL and
QR payload were built with an empty token (token=). The gateway accepted
the saved token, but the app never received it, so pairing was impossible.

Assign the generated value back to `token` so the pairing URL/QR carry it.
Add a regression test (test_interactive_setup_generates_token_in_pairing_url).

gateway-plugin/setup.py

@@ -481,9 +481,9 @@ def interactive_setup() -> None:
     print_info("📱 Android / Desktop (Iris x Hermes)")
     token = get_env_value("IRIS_TOKEN") or ""
     if not token:
-        generated = generate_token()
-        save_env_value("IRIS_TOKEN", generated)
-        print_success(f"Generated pairing token: {generated}")
+        token = generate_token()
+        save_env_value("IRIS_TOKEN", token)
+        print_success(f"Generated pairing token: {token}")
         print_warning("Keep this secret -- the app presents it on connect.")
     else:
         print_info("Existing IRIS_TOKEN found (not shown).")