fix(cursor-daemon): auto-generate token + expose for callers (#1384)

PRs #1373/#1377 gated cursor daemon endpoints behind a token check, but
startDaemon() did not generate or expose a token. Health-check probing
during startup then 401'd against the new auth, so startDaemon waited 30s
then reported failure. Same for tests asserting /404 and validation
behavior — they couldn't reach the downstream logic past the 401 gate.

- Auto-generate a 32-byte hex token in startDaemon when caller did not
  provide one
- Return daemonToken in startDaemon result so callers/tests can attach it
- Update integration tests to include x-ccs-cursor-token header

tests/integration/cursor-daemon-lifecycle.test.ts

@@ -43,12 +43,14 @@ describe('cursor daemon lifecycle smoke', () => {
 
     const result = await startDaemon({ port, ghost_mode: true });
     expect(result.success).toBe(true);
+    const daemonToken = result.daemonToken as string;
 
     const response = await fetch(`http://127.0.0.1:${port}/v1/messages`, {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
         'anthropic-version': '2023-06-01',
+        'x-ccs-cursor-token': daemonToken,
       },
       body: JSON.stringify({
         model: 'claude-sonnet-4.5',
@@ -71,8 +73,9 @@ describe('cursor daemon lifecycle smoke', () => {
     const result = await startDaemon({ port, ghost_mode: true });
     expect(result.success).toBe(true);
     expect(result.pid).toBeDefined();
+    const daemonToken = result.daemonToken as string;
 
-    expect(await isDaemonRunning(port)).toBe(true);
+    expect(await isDaemonRunning(port, daemonToken)).toBe(true);
 
     const modelsResponse = await fetch(`http://127.0.0.1:${port}/v1/models`);
     expect(modelsResponse.status).toBe(200);
@@ -82,7 +85,7 @@ describe('cursor daemon lifecycle smoke', () => {
 
     const chatResponse = await fetch(`http://127.0.0.1:${port}/v1/chat/completions`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', 'x-ccs-cursor-token': daemonToken },
       body: JSON.stringify({
         model: 'gpt-4.1',
         messages: [{ role: 'user', content: 'hello' }],
@@ -95,6 +98,7 @@ describe('cursor daemon lifecycle smoke', () => {
       headers: {
         'Content-Type': 'application/json',
         'anthropic-version': '2023-06-01',
+        'x-ccs-cursor-token': daemonToken,
       },
       body: JSON.stringify({
         model: 'claude-sonnet-4.5',
@@ -113,15 +117,18 @@ describe('cursor daemon lifecycle smoke', () => {
 
     const stopResult = await stopDaemon();
     expect(stopResult.success).toBe(true);
-    expect(await isDaemonRunning(port)).toBe(false);
+    expect(await isDaemonRunning(port, daemonToken)).toBe(false);
   }, 35000);
 
   it('returns 404 for unknown routes', async () => {
     const port = 10000 + Math.floor(Math.random() * 50000);
     const result = await startDaemon({ port, ghost_mode: true });
     expect(result.success).toBe(true);
+    const daemonToken = result.daemonToken as string;
 
-    const response = await fetch(`http://127.0.0.1:${port}/unknown`);
+    const response = await fetch(`http://127.0.0.1:${port}/unknown`, {
+      headers: { 'x-ccs-cursor-token': daemonToken },
+    });
     expect(response.status).toBe(404);
   });
 
@@ -138,10 +145,11 @@ describe('cursor daemon lifecycle smoke', () => {
 
     const result = await startDaemon({ port, ghost_mode: true });
     expect(result.success).toBe(true);
+    const daemonToken = result.daemonToken as string;
 
     const response = await fetch(`http://127.0.0.1:${port}/v1/chat/completions`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', 'x-ccs-cursor-token': daemonToken },
       body: JSON.stringify({
         model: 'gpt-4.1',
         messages: [{ role: 'user', content: 'hello' }],
@@ -157,17 +165,19 @@ describe('cursor daemon lifecycle smoke', () => {
     const port = 10000 + Math.floor(Math.random() * 50000);
     const result = await startDaemon({ port, ghost_mode: true });
     expect(result.success).toBe(true);
+    const daemonToken = result.daemonToken as string;
+    const tokenHeader = { 'x-ccs-cursor-token': daemonToken };
 
     const invalidJson = await fetch(`http://127.0.0.1:${port}/v1/chat/completions`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', ...tokenHeader },
       body: '{invalid-json',
     });
     expect(invalidJson.status).toBe(400);
 
     const invalidSchema = await fetch(`http://127.0.0.1:${port}/v1/chat/completions`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', ...tokenHeader },
       body: JSON.stringify({
         model: 'gpt-4.1',
         messages: { role: 'user', content: 'hello' },
@@ -180,6 +190,7 @@ describe('cursor daemon lifecycle smoke', () => {
       headers: {
         'Content-Type': 'application/json',
         'anthropic-version': '2023-06-01',
+        ...tokenHeader,
       },
       body: JSON.stringify({
         model: 'claude-sonnet-4.5',
@@ -198,7 +209,7 @@ describe('cursor daemon lifecycle smoke', () => {
 
     const oversized = await fetch(`http://127.0.0.1:${port}/v1/chat/completions`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', ...tokenHeader },
       body: JSON.stringify({
         model: 'gpt-4.1',
         messages: [