feat(notfair): add NotFair third-party MCP plugin

[ununununium]

Summary

• Add the notfair plugin under third_party/notfair/, pointing at NotFair's hosted MCP server (https://notfair.co/api/mcp/notfair) over Streamable HTTP. NotFair is a marketing workspace for Google, Meta, X, LinkedIn, Reddit, and TikTok Ads plus GA4, Search Console, GoHighLevel, and WordPress; one OAuth connection covers every supported platform.
• Auth is OAuth 2.1 with Dynamic Client Registration and PKCE, discovered from the server (WWW-Authenticate + protected-resource metadata). There is no API key, client ID, or template variable in the plugin. Protected-resource metadata: https://notfair.co/.well-known/oauth-protected-resource/api/mcp/notfair
• Register the plugin in .cursor-plugin/marketplace.json and the root README table (Integrations, author Notfair).

Notes for reviewers

• Source of truth for the plugin is https://github.com/nowork-studio/notfair-plugin (MIT, version 0.27.9); this directory is its Cursor packaging.
• This package is MCP-first. The source repo ships 48 open-source SEO, GEO, and content skills, but those wrappers resolve to canonical files outside skills/ and would make this PR unwieldy. Skills remain in the source repository.
• The same plugin was previously also submitted through cursor.com/marketplace/publish; this PR carries the packaging so it can be reviewed here.
• Logo is NotFair's brand mark (512×512 PNG) from the source repository.

Test plan

• node scripts/validate-plugins.mjs passes (after npm install --no-save ajv ajv-formats)
• Install from Cursor Settings → Plugins or /add-plugin notfair, complete the Connect to NotFair step
• Smoke test a read-only briefing (for example GA4 or Search Console) after connecting a workspace

---

Note

Medium Risk
Introduces a new external hosted MCP with OAuth and potential write access to ads, analytics, WordPress, and CRM data; changes are packaging-only but expand agent reach into production marketing systems.

Overview
Adds the NotFair third-party Cursor plugin (third_party/notfair/) and registers it in .cursor-plugin/marketplace.json and the root README integrations table.

The package is MCP-first: mcp.json points at NotFair’s hosted Streamable HTTP server (https://notfair.co/api/mcp/notfair) so agents can work across Google/Meta/X/LinkedIn/Reddit/TikTok Ads, GA4, Search Console, GoHighLevel, and WordPress from one OAuth connection (no per-platform MCP entries). Auth is OAuth 2.1 with DCR and PKCE discovered from the server—no API keys or client secrets in the repo. Manifest, README, CHANGELOG, and MIT license document install flow and capabilities; open-source SEO/content skills from the upstream repo are intentionally not bundled in this packaging PR.

^{Reviewed by Cursor Bugbot for commit 8848b21. Bugbot is set up for automated code reviews on this repo. Configure here.}