feat: install Cursor Agent CLI in image with API key auth

Bake agent into the pi user PATH; pass CURSOR_API_KEY from .env so no browser login is required.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -3,6 +3,10 @@
 # OpenRouter (recommended default provider for this stack)
 OPENROUTER_API_KEY=sk-or-v1-replace-me
 
+# Cursor Agent CLI (https://cursor.com/dashboard/api)
+# https://cursor.com/docs/cli/reference/authentication
+CURSOR_API_KEY=key_replace_me
+
 # Match host user that owns the workspace mount (boka: id -u / id -g → 1002)
 PUID=1002
 PGID=1002