fix(headers): MutableHeaders.pop() compatibility + dev environment setup

[Bobcatsfan33]

Summary

• Fix MutableHeaders.pop() call in modules/security/headers.py that fails across all starlette versions (starlette's MutableHeaders has never exposed a pop() method). Replaced with a guard + del pattern.
• Add AGENTS.md with Cursor Cloud specific development instructions covering required services, environment caveats, and key commands.

Type of Change

• Bug fix
• Documentation

Security Review Checklist

• No secrets, credentials, or API keys introduced
• No weakening of existing authentication or authorization controls
• No new external network calls without approval
• Input validation applied to all new user-controlled values
• Error messages do not leak internal system details
• If touching auth, crypto, or remediation — I have documented why this is safe

Testing

Verified environment is fully functional:

• ruff check . — all checks passed
• pytest tests/ -v — 155/155 tests passed
• DEV_MODE=true uvicorn api:app --reload — app starts successfully
• curl http://localhost:8000/ — health check returns {"service": "TokenDNA", "redis": true, "dev_mode": true}
• curl http://localhost:8000/secure — token integrity check works with synthetic dev-user

dev_environment_test_output.log

Related Issues

N/A — discovered during development environment setup.

_{To show artifacts inline, enable in settings.}