fix: generate a per-installation root CA

internal/client/cursor.go

@@ -5,6 +5,7 @@ import (
 	goruntime "runtime"
 
 	"cursor/internal/cursor"
+	"cursor/internal/logger"
 )
 
 // ApplyCursorSettings 用于处理与 ApplyCursorSettings 相关的逻辑。
@@ -21,6 +22,9 @@ func (s *ProxyService) ApplyCursorSettings() error {
 	if err != nil {
 		return fmt.Errorf("ensure ca cert file: %w", err)
 	}
+	if err := cursor.EnsureLegacySharedCACertRemoved(); err != nil {
+		logger.Errorf("remove legacy shared ca cert failed, continuing with installation CA: %v", err)
+	}
 
 	switch goruntime.GOOS {
 	case "windows":