feat(cursor): add the marketplace plugin manifest

[rbatista191]

What

Makes this repo submittable to the official Cursor marketplace at cursor.com/marketplace/publish.

• .cursor-plugin/plugin.json — manifest, declares CLORO_API_KEY as the one required variable
• mcp.json — points at https://mcp.cloro.dev/mcp with Authorization: Bearer ${CLORO_API_KEY}
• assets/logo.svg — the square icon mark, committed and referenced by relative path as the checklist requires
• src/cursor-plugin.test.ts — 6 guards
• README — an "In Cursor" section

Why

MAR-255 listed cloro on cursor.directory, which is the community index. The official marketplace is a separate submit-and-review surface and needs a public repo carrying a plugin manifest. No public repo existed when MAR-255 closed, which is why it was never attempted; MAR-295 made this repo public.

Cursor stores the key its side and sends it as a header, so this listing avoids the path-embedded key form that MAR-255 records as the recurring friction point.

Tested

Against the live mcp.cloro.dev with header auth, which is the exact config in mcp.json:

• initialize returns serverInfo cloro 0.1.0
• tools/list returns all 10 tools, each with readOnlyHint: true

npx vitest run 40/40 pass, tsc --noEmit clean.

On the test

Three checklist items cost a review round trip rather than a test failure, so they are guarded:

• the version now lives in a fourth file, alongside package.json, server.json and src/server.ts
• the logo must be committed and its path relative, no .. and no leading /
• every ${VAR} in mcp.json must be declared in the manifest variables and marked required. This is the one failure with no local symptom: an undeclared placeholder is never prompted for, so the server 401s for every user who installs the plugin.