Preserve context when switching into Cursor CLI OAuth

### What do you want to change?

When an existing Senpi conversation switches from another provider to `cursor-cli-oauth`, pass a bounded recap of recent Senpi-owned context into the first Cursor turn. Keep model-switch and provider-switch controls independent, and never move recap text across Cursor accounts.

### Why?

The Cursor CLI subprocess otherwise receives only the latest user prompt and answers as if the ongoing conversation were new. This breaks provider switching in long-running sessions.

### How?

Detect the provider transition at the Cursor stream boundary, route the existing bounded recap through the session router, preserve explicit opt-outs through restart fallback, and persist only account-ownership metadata so process restarts fail closed across accounts. Implementation and tests are in #1241.

Start with the implementation and tests referenced in #1241, then trace the Cursor stream boundary and session router. Check the restart fallback and account-ownership metadata paths, with explicit opt-outs and cross-account recap isolation as the completion criteria.

Written by the indexing model from the issue text.