feat(server): Add readOnly mode to Cursor provider for read-only operations

Adds a readOnly option to ExecuteOptions that controls whether the
Cursor CLI runs with --force flag (allows edits) or without (suggest-only).

Read-only routes now pass readOnly: true:
- generate-spec.ts, generate-features-from-spec.ts (we write files ourselves)
- validate-issue.ts, generate-suggestions.ts (analysis only)
- describe-file.ts, describe-image.ts (description only)
- generate-plan.ts, enhance.ts (text generation only)

Routes that implement features (auto-mode-service, agent-service) keep
the default (readOnly: false) to allow file modifications.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/server/src/providers/cursor-provider.ts

@@ -140,12 +140,18 @@ export class CursorProvider extends CliProvider {
     // shell escaping issues when content contains $(), backticks, etc.
     const cliArgs: string[] = [
       '-p', // Print mode (non-interactive)
-      '--force', // Allow file modifications
       '--output-format',
       'stream-json',
       '--stream-partial-output', // Real-time streaming
     ];
 
+    // Only add --force if NOT in read-only mode
+    // Without --force, Cursor CLI suggests changes but doesn't apply them
+    // With --force, Cursor CLI can actually edit files
+    if (!options.readOnly) {
+      cliArgs.push('--force');
+    }
+
     // Add model if not auto
     if (model !== 'auto') {
       cliArgs.push('--model', model);

apps/server/src/providers/types.ts

@@ -34,6 +34,12 @@ export interface ExecuteOptions {
   conversationHistory?: ConversationMessage[]; // Previous messages for context
   sdkSessionId?: string; // Claude SDK session ID for resuming conversations
   settingSources?: Array<'user' | 'project' | 'local'>; // Claude filesystem settings to load
+  /**
+   * If true, the provider should run in read-only mode (no file modifications).
+   * For Cursor CLI, this omits the --force flag, making it suggest-only.
+   * Default: false (allows edits)
+   */
+  readOnly?: boolean;
 }
 
 /**