Address review findings: env-only API key, acpRawDebug test, acp-client tests

- Remove CURSOR_API_KEY from argv; pass only via acpEnv
- Add config test for CURSOR_BRIDGE_ACP_RAW_DEBUG=1
- Add acp-client.test.ts with skipAuthenticate and fake ACP server