feat(third_party): add Webull plugin

[minupalaniappan]

Summary

• Add Webull as a third_party/ marketplace plugin, in the Attio (Add Attio third-party MCP plugin #339) / Hunter (Add Hunter third-party MCP plugin (API key header auth) #340) shape.
• One of nine hosted-MCP connectors that grok.com offers publicly (GrowthBook visibility all) and the Cursor marketplace does not. The server URL matches Grok's production connector_catalog.mcp_server_url.
• Registers the plugin in .cursor-plugin/marketplace.json and the root README table.
• Stacked on feat(third_party): add Gamma plugin #347 (minu/plugin-gamma). Merge that first, or retarget this PR to main after it lands.

Endpoint	https://api.webull.com/mcp
Auth	OAuth with dynamic client registration. Probed: 401; authorization-server metadata at api.webull.com with registration_endpoint.
Grok visibility	all

MCP

{
  "mcpServers": {
    "webull": {
      "type": "http",
      "url": "https://api.webull.com/mcp"
    }
  }
}

Stack

Split from #345 into one PR per plugin. Independent plugins come first; the two with external prerequisites (Coinbase, BigQuery) are last so they never block the others.

1. gamma feat(third_party): add Gamma plugin #347
   2. webull feat(third_party): add Webull plugin #348 ← this PR
2. sp-global feat(third_party): add S&P Global plugin #349
3. interactive-brokers feat(third_party): add Interactive Brokers plugin #350
4. meltwater feat(third_party): add Meltwater plugin #351
5. daloopa feat(third_party): add Daloopa plugin #352
6. excalidraw feat(third_party): add Excalidraw plugin #353
7. coinbase feat(third_party): add Coinbase plugin #354
8. google-cloud-bigquery feat(third_party): add Google Cloud BigQuery plugin #355

Test plan

• node scripts/validate-plugins.mjs passes on this branch
• Endpoint probed for OAuth discoverability and dynamic client registration; the auth shape above is what the server actually supports
• README has Install / MCP / Before you connect / What agents can do / Notes / Docs / License, with capabilities sourced from vendor docs
• marketplace.json, plugin.json, and README table descriptions are identical
• Logo visually reviewed at 192×192
• Install from Cursor Settings → Plugins, complete sign-in, and smoke test get_account_list

Notes

• The hosted server is read-only for trading; order placement lives only in Webull's local MCP server.
• Hong Kong accounts use a separate regional endpoint that is not configured here.

---

Note

Low Risk
Additive marketplace plugin and documentation only; no changes to core auth or runtime beyond listing a remote OAuth MCP endpoint.

Overview
Adds a new Webull third-party Cursor plugin so users can connect agents to Webull’s hosted MCP at https://api.webull.com/mcp via OAuth (no API key in mcp.json).

Registers webull in .cursor-plugin/marketplace.json and the root README plugin table, and introduces third_party/webull/ with manifest, mcp.json, README (install, capabilities, read-only trading note), changelog, and MIT license—same shape as other integration plugins like Hunter/Gamma.

^{Reviewed by Cursor Bugbot for commit 3639284. Bugbot is set up for automated code reviews on this repo. Configure here.}