Security:
- Validate X-Acp-Session as UUID format to prevent socket protocol injection
- Block dangerous env vars (PATH, LD_PRELOAD, etc.) in acpEnv
- Tighten daemon socket permissions from 0660 to 0600

Dead code removal:
- Remove unused AcpClient, AcpClientFactory, AcpTransport and their interfaces
- Remove corresponding tests (19 tests for dead code)
- Clean up mago lint baseline (11 stale entries)

Documentation:
- Update website/guide/ai-chat.md: add ACP provider section, session lifecycle,
  daemon architecture, updated settings table and architecture diagram
- Update website/api/rest.md: multi-session ACP connect flow, X-Acp-Session
  header, daemon protocol, response format
- Update libs/API/CLAUDE.md: reflect new file structure
- Update libs/frontend/CLAUDE.md: add Llm/acpSession.ts module

https://claude.ai/code/session_01W4kLoG2QdFrRYqkVyJF6df