feat: add Cursor Provider plugin

[davidfarah2003]

Adds the Cursor Provider plugin to the registry.

• Repository: https://github.com/davidfarah2003/cliproxy-cursor-provider
• Latest release: v0.4.0, with archives for linux amd64/arm64, darwin amd64/arm64, and windows amd64 in the store naming scheme (cursor_0.4.0_<goos>_<goarch>.zip) plus checksums.txt.

The plugin registers Cursor as an upstream provider: OAuth login from the management panel (or a session token for headless installs), dynamic model discovery, streaming, client-executed tool calls, usage accounting through the native OpenAI executor, and a Cursor Quota management page.

Validation: registry.json parses, id is unique and matches the plugin ID rules, repository is exactly https://github.com/{owner}/{repo}, and no version field is pinned so the store reads the latest release.

[LTbinglingfeng]

Thank you for submitting your plugin to the CLIProxyAPI Plugins Store.

During the security and architectural audit, we identified a violation of the CPA route boundary policy:

• Unsafe /v0/resource/plugins/ design: The plugin registers a resource route at /quota (/v0/resource/plugins/cursor/quota) via managementRegistration() and renderQuotaPage() in quota.go. When accessed, this route triggers dynamic business logic and unauthenticated outbound API requests to Cursor using stored account credentials, dynamically exposing account email addresses, subscription statuses, spend limits, quotas, and gateway metrics in the response HTML.
• Route boundary policy violation: /v0/resource/plugins/ is not protected by the CPA Management key and is allowed to contain static deployed resources only. It must not be used for non-static resources, dynamic state responses, business logic, or credential-bearing requests.

All dynamic APIs, state operations, and management views must be registered under authenticated /v0/management/plugins/... endpoints.

This PR is being closed in accordance with the store security policy. An issue has been opened in the plugin repository with details. You are welcome to resubmit after refactoring the resource route to serve only static assets and moving dynamic data retrieval behind authenticated management routes.