feat(cursor): multi-account routing with round-robin and session isolation

- Add cursor/filename.go for multi-account credential file naming
- Include auth.ID in session and checkpoint keys for per-account isolation
- Record authID in cursorSession, validate on resume to prevent cross-account access
- Management API /cursor-auth-url supports ?label= for creating named accounts
- Leverages existing conductor round-robin + failover framework

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/auth/cursor/filename.go

@@ -0,0 +1,16 @@
+package cursor
+
+import (
+	"fmt"
+	"strings"
+)
+
+// CredentialFileName returns the filename used to persist Cursor credentials.
+// It uses the label as a suffix to disambiguate multiple accounts.
+func CredentialFileName(label string) string {
+	label = strings.TrimSpace(label)
+	if label == "" {
+		return "cursor.json"
+	}
+	return fmt.Sprintf("cursor-%s.json", label)
+}