docs: add Cursor Cloud dev environment setup instructions

[qCanoe]

Summary

Sets up and documents the development environment for the Web3 Signature Decoder monorepo. No application code was changed — this only adds AGENTS.md with durable, non-obvious setup guidance for future cloud agents. The startup update script (dependency install + workspace library builds) is configured separately.

What was verified

• npm install — installs all workspace deps (Node 22.14, npm 10.9).
• Build — all packages compile (tsc per package; snap via mm-snap build).
• Tests — npm run test: 25 Vitest harness tests + 1 Jest snap test all pass.
• Run (dev mode) — test-api (:4000), test-web (:4173), site (:8000) all serve.
• Hello-world (deterministic, no key) — phishing fake-Uniswap-permit fixture → decision: block / policyReason: high_risk via fail-closed path.
• Hello-world (full LLM path, with OPENAI_API_KEY) — benign SIWE login → decision: allow / llm.status: ok; phishing → block; POST /v2/fixtures/validate → pass: true across all 8 fixtures.

Key non-obvious findings (captured in AGENTS.md)

• Apps/tests import the compiled dist/ of @sd/* packages, so the library packages must be built before dev/test work.
• test-api defaults to port 4005 in code, but test-web/README default the API base to http://localhost:4000 — run the API on 4000.
• Without OPENAI_API_KEY the engine is fail-closed: benign requests return error, critical-signal requests still block; /v2/fixtures/validate returns pass: false. With the key, benign requests return allow and validation passes.
• No lint script / no committed ESLint/Prettier config — strict tsc build is the effective static check.
• clean npm scripts use PowerShell syntax and fail on Linux.

Demo

Full LLM-powered flow (ALLOW / BLOCK / validate pass):

signature_decoder_llm_flow_demo.mp4

Benign SIWE login allowed via LLM
All fixtures validate pass:true

Deterministic fail-closed block (no key):

Phishing permit blocked

_{To show artifacts inline, enable in settings.}