v0.3.9

fix(cursor): pull token usage from server-side dashboard API

Cursor stopped writing tokenCount into local bubble records around early
2026, leaving devkat unable to track Cursor token burn for any session
created since then. This restores tracking by pulling usage events from
api2.cursor.sh's DashboardService/GetFilteredUsageEvents using the JWT
Cursor.app already stores in state.vscdb.

• New CursorAPI module: reads accessToken from local state.vscdb,
  validates the JWT exp claim, paginates through usage events.
• attributeCursorEvents: matches each API event to exactly one composer
  via nearest-bubble timestamp (60s tolerance) so concurrent composers
  don't double-count shared events.
• parseCursorSessions accepts a cutoff parameter that filters local
  bubbles and API events to the install timestamp, preventing pre-install
  activity from leaking in via composers that straddle install.
• Daemon.syncAll fetches events once per cycle and passes per-composer
  slices to the parser.
• --cursor-test diagnostic flag verifies cutoff is respected, no
  pre-cutoff segments leak, and attributed total never exceeds API total.

Verified locally: 103 pre-cutoff composers correctly skipped, 4
post-cutoff composers attributed without double-counting, current session
now reports 346.5k tokens (was 0).

Co-authored-by: Cursor cursoragent@cursor.com