Add Cloud Agent development environment

[ceedot-rock]

Summary

Adds a Cloud Agent development environment for Agent-Rider (Next.js app in src/, Supabase + Stripe + MCP). This is a repository-managed environment: merging this PR activates it for future Cloud Agents (no dashboard Save needed).

• .cursor/environment.json — default base image; install runs .cursor/install.sh; a web terminal runs cd src && npm run dev; port 3000 exposed.
• .cursor/install.sh — idempotent bootstrap: npm ci in src/, and on first run generates src/.env.local with safe placeholder values plus a throwaway ES256 rider keypair so the app builds and boots without external accounts. Real secrets injected as environment variables take precedence (Next.js does not override already-set process.env), so setting the matching Cursor secrets transparently upgrades the app to live Supabase/Stripe.

No production credentials are committed. src/.env.local is gitignored and generated at install time.

Validation (local VM)

Check	Result
.cursor/install.sh (npm ci + env gen)	Succeeded; idempotent (second run leaves .env.local untouched)
npm run build (mirrors CI webpack.yml)	Compiled + all routes generated
Dev server (npm run dev)	Ready; GET / → HTTP 200
GET /api/health	{"status":"ok", ready:{rider:true, stripe:true, db:false}}
Read endpoints /api/spec, /api/discovery, /.well-known/agent.json, /llms.txt	HTTP 200
Pages /docs, /board, /demo, /start	HTTP 200
POST /api/mcp tools/list	Returns tool catalog
Rider credential flow POST /api/rider/verify	Valid token → valid:true; tampered → valid:false

Validation (prebuilt environment build + fresh Cloud Agent)

• Draft environment build bld-20260911-eaa24f55-b99e-453c-a285-58058017ff84 SUCCEEDED from a clean checkout of this branch: .cursor/install.sh ran npm ci (138 packages) and generated .env.local (exit 0).
• A fresh Cloud Agent booted from that exact build and passed end-to-end: Node 22, node_modules present, .env.local with all 7 keys, dev server → HTTP 200, /api/health ok, and rider verify (valid token → valid:true, tampered → valid:false).

The db:false health flag is expected: the placeholder Supabase host is intentionally unreachable until real credentials are provided.