Severity

HIGH

Summary

All participants supplied via combat_manage create are treated as AC 10 regardless of the ac value in the participant object. Vela was configured with AC 18 but was hit by an attack rolling 16-vs-AC10. Same defect for spawned enemies.

Reproduction

```json
combat_manage create {
participants: [
{ id: "vela", name: "Vela", side: "party", hp: 38, maxHp: 38, ac: 18, ... }
]
}
```

Then any attack against Vela shows vs AC 10 in the roll line.

Acceptance

• Participant ac propagates to encounter state and is used for attack resolution
• Render/state APIs include the actual AC value
• Add regression test: create encounter with non-default AC, attack, verify the threshold

Discovered During

Live MCP session test on 2026-04-17. Related to side-field bug (separate issue) — both look like the encounter creator only consumes a subset of fields from the input.