That HTTP ERROR 431 is coming from the local sign-in callback, not from Supabase. When Cursor finishes the OAuth handoff it opens a page at localhost:8787, and your browser sends every cookie it has stored for localhost along with that request. If those cookies have grown large (common when you run local dev servers on localhost), they go over the size the callback accepts, so it returns 431 before sign-in can finish.
To get unblocked:
Clear cookies for localhost in your default browser (this only signs you out of things running locally).
In Cursor, go to Settings → MCP Servers → Supabase → Connect and try again.
Alternatively, open the Supabase auth link in a private/incognito window and finish sign-in there, since that window starts with no localhost cookies. Let me know if it still trips up after that!