Add Agent Counsel Comment

Delegated quote-anchored comment write for an agent-counsel reviewer.

Agent-service calls this with its agent JWT instead of writing to hocuspocus directly; fastapi signs the HMAC envelope and relays. The author is the reviewer named in the verified JWT — never request input — so the agent cannot comment as anyone else. Authorized by the cap plus an open ReviewRequest for (reviewer_id, snapshot_id), matching the context route; refuses once the review is finished or cancelled.