feat: install Cursor Agent CLI in image with API key auth

Bake agent into the pi user PATH; pass CURSOR_API_KEY from .env so no browser login is required.

Co-authored-by: Cursor <cursoragent@cursor.com>

DEPLOY.md

@@ -18,7 +18,7 @@ ssh frank-schwenk.de
 cd /home/frank/pi.schwenk.online
 
 cp .env.example .env
-# edit OPENROUTER_API_KEY
+# edit OPENROUTER_API_KEY and CURSOR_API_KEY (https://cursor.com/dashboard/api)
 # PUID/PGID = host user (frank on boka: 1002) — must match `id -u` / `id -g`
 # WORKSPACE_HOST_PATH=/home/frank
 
@@ -43,6 +43,8 @@ docker compose exec web ls /workspaces/eselhoefe.de
 6. Packages: Settings → Pi packages, or  
    `docker compose exec sessiond pi install npm:<package>`  
    (persists in `data/pi-agent`)
+7. Cursor CLI: `docker compose exec web agent --version`  
+   Auth: `docker compose exec web agent status` (needs `CURSOR_API_KEY` in `.env`)
 
 ## Ops
 
@@ -60,3 +62,4 @@ docker compose build --no-cache && docker compose up -d
 - Middleware is referenced only (`authelia@docker`); ForwardAuth is defined on Authelia
 - `pi-coding-agent` pinned to `0.82.1` for current `pi-web` peer range
 - Container runs as `PUID`/`PGID` (default 1002) so bind mounts under `/home/frank` are readable
+- Cursor Agent CLI (`agent`) is in the image; auth via `CURSOR_API_KEY` only (no browser login)