docs(cursor): add Phantom + Cursor tutorial

[mvanhorn]

What this changes

Adds docs/cursor.md, a step-by-step Cursor + Phantom tutorial parallel
to the existing docs/claude-code.md. Covers install, MCP server
registration in ~/.cursor/mcp.json / .cursor/mcp.json (both UI and
file-edit forms), running Cursor under phantom exec, the 24 MCP
tools Cursor gains, a sample workflow (adding a Stripe key without
exposing the value), and a Cursor-specific troubleshooting section
(MCP picker doesn't see the server, vault not initialised, TLS errors,
stale phm_ tokens).

Closes #38.

How to verify

ls docs/cursor.md
grep -n "cursor.md" README.md apps/web/public/llms.txt apps/web/src/app/sitemap.ts

The new file is wired into:

• README.md Links section (alongside the existing Claude Code link)
• apps/web/public/llms.txt Documentation list
• apps/web/src/app/sitemap.ts (next to the existing docs/claude-code.md
  sitemap entry, same priority and changeFrequency)

Sitemap braces balance: 22/22 in node. The TS still parses cleanly
under the existing project structure; no new imports.

Notes for the reviewer

I read the closing comment on #41 carefully and grounded every claim
in this tutorial against repo source rather than memory:

Maintainer correction on #41	What this PR does
Install command isn't npm install -g phantom-secrets	Uses npx phantom-secrets init from docs/claude-code.md and apps/web/public/llms.txt
Cursor integration is via the MCP server, not a "Phantom Secrets" Settings panel	Step 2 reaches Cursor through the MCP server JSON; the JSON shape comes from apps/web/src/components/landing/Install.tsx (canonical client list)
Config file is .phantom.toml, not .phantom/config.json	Step 1 lists .phantom.toml
Runtime is the local reverse proxy substituting phm_ tokens, not auto-injected os.getenv	"Why this combination exists" + Step 3 describe the proxy on 127.0.0.1 and phm_ tokens, matching claude-code.md's explanation
Commands are phantom exec and phantom login, not phantom run / phantom auth login	Tutorial only uses phantom exec, phantom doctor, phantom_* MCP tools — all from crates/phantom-cli/src/commands/ and claude-code.md

I deliberately did not include screenshots — the issue allows
"placeholder ![alt](TODO) if you don't have Cursor", and I'd rather
ship verified prose than fabricated screenshot URLs. Happy to add real
images in a follow-up once someone with a Cursor install can drop them
in apps/web/public/docs/.

The tutorial points back to docs/claude-code.md for the full 24-tool
catalogue rather than duplicating that table — the contract is
identical for both clients, and a single source of truth means the
Cursor doc won't drift if the tool set changes.

Checklist

• No real secret values in the diff
• Docs updated (README.md, apps/web/public/llms.txt, sitemap)
• cargo test/cargo clippy not run — this PR touches no Rust;
  docs-only change