fix(cursor): address remaining PR #528 review feedback

- Add comment explaining whitelist merge pattern in PUT /settings
- Add comment for bare 'ccs cursor' fallthrough (differs from copilot)
- Add unit tests for cursor settings routes validation logic
  - Tests for null/non-object/array body rejection
  - Tests for port validation (integer, range 1-65535)
  - Tests for auto_start/ghost_mode boolean validation
  - Tests for whitelist merge (ignores unknown properties)
  - Tests for /settings/raw validation and file operations
  - Tests for mtime conflict detection

All web-server tests pass. Pre-existing test failures unrelated.

src/web-server/routes/cursor-settings-routes.ts

@@ -63,6 +63,7 @@ router.put('/', (req: Request, res: Response): void => {
     const config = loadOrCreateUnifiedConfig();
 
     // Merge updates with existing config
+    // Only known fields (port, auto_start, ghost_mode) are merged — unknown properties are ignored
     config.cursor = {
       port: updates.port ?? config.cursor?.port ?? DEFAULT_CURSOR_CONFIG.port,
       auto_start: