fix(cursor-daemon): widen safeResolve type for daemonToken (#1385)

* fix(cursor-daemon): auto-generate token + expose for callers

PRs #1373/#1377 gated cursor daemon endpoints behind a token check, but
startDaemon() did not generate or expose a token. Health-check probing
during startup then 401'd against the new auth, so startDaemon waited 30s
then reported failure. Same for tests asserting /404 and validation
behavior — they couldn't reach the downstream logic past the 401 gate.

- Auto-generate a 32-byte hex token in startDaemon when caller did not
  provide one
- Return daemonToken in startDaemon result so callers/tests can attach it
- Update integration tests to include x-ccs-cursor-token header

* fix(cursor-daemon): widen safeResolve type for daemonToken field

src/cursor/cursor-daemon.ts

@@ -173,7 +173,12 @@ export async function startDaemon(
     let proc: ChildProcess;
     let resolved = false;
 
-    const safeResolve = (result: { success: boolean; pid?: number; error?: string }) => {
+    const safeResolve = (result: {
+      success: boolean;
+      pid?: number;
+      error?: string;
+      daemonToken?: string;
+    }) => {
       if (resolved) return;
       resolved = true;
       if (checkTimeout) clearTimeout(checkTimeout);