Replace totalRows pagination with cursors on the list endpoints

[alistair3149]

Fixes #1062.

The Problem

GET /schemas, GET /layouts, and GET /mappings filtered unreadable rows out of their pages but reported an unfiltered namespace count in totalRows. Subtracting the visible rows from that total gave any caller the number of read-restricted Schemas, Layouts, and Mappings. That is the count oracle of #1062, plus the third instance on /mappings noted there.

Why Drop totalRows and Paginate by Cursor

Two dead ends shaped the fix:

1. An honest total is expensive. The only totalRows that does not leak is the count of rows the caller may read. Computing that count takes a per-title permission check across the entire namespace on every request, and each check fires the ACL hook that per-page read restriction depends on.
2. Offset pagination cannot seek a permission-filtered list. The server can only find the rows at offset 40 by re-checking rows 1–40, so every page re-scans the namespace from the start. A full enumeration costs O(R²/page size) permission checks: tolerable at today's tens of Schemas, untenable at the thousands a deployment can accumulate.

Dropping totalRows and paginating by cursor resolves both at once. With no total there is nothing to leak, so the oracle closes structurally rather than by computing a safe number. A cursor resumes the listing where it left off, so a request costs only the rows it serves.

What Changed

API contract (all three list endpoints). Requests take limit (1–50, default 10) and an optional opaque cursor; responses are { schemas|layouts|mappings: [...], "nextCursor": string|null }, where null means the listing is exhausted. A malformed cursor gets a structured 400. The endpoints skip restricted rows exactly like nonexistent ones: no page space, no trace in the cursor, which only ever carries the page ID of a row the caller was served.

Persistence. The three name lookups are now keyset generators: getReadable*Names( int $afterPageId = 0 ): iterable<pageId, name>. Each batch seeks past the last seen page ID (WHERE page_id > cursor ORDER BY page_id LIMIT 100) and re-checks per-title read (RIGOR_FULL) against the request authority. MappingNameLookup::getMappingNames() stays unfiltered for the system-context RDF-projection and DumpRdf path. A shared CursorPaginationTrait carries the param settings, cursor parsing, and page-fill loop; the loop skips readable-but-malformed rows, so a short page always means the end.

Frontend. The new useCursorPagination composable maps CdxTable's offset-based server pagination onto cursors through a per-row-offset cursor history. Row offsets are limit-independent, so a page-size change stays aligned with the offset CdxTable keeps. The tables run the indeterminate "X–Y of many" pagination until a null cursor reveals the exact count, then switch to it. Without the switch, CdxTable's next-button heuristic (a short page) would miss a listing that ends exactly on a page boundary. Full enumeration in the schema picker follows nextCursor instead of counting rows.

Docs. New Cursor pagination section in docs/api/rest-api.md; the Permissions section now also lists the Mapping read endpoint (a gap noted on #1062).

Follow-up filed: #1130, search-first pickers and tables, the remaining large-namespace bottleneck.

Testing

• Persistence: keyset semantics per lookup (keyed by page ID, starts after the cursor, restricted rows never yielded); getMappingNames pinned unfiltered.
• Handlers: cursor walks across pages, the exact-boundary end, past-the-end and integer-saturating cursors, malformed cursor → 400, and end-to-end read denial via a getUserPermissionsErrors hook on the request authority for all three endpoints. A restricted row leaves no gap in the page and no trace in the cursor; sabotage checks confirm the denial and determinate-flip tests fail when the fix is removed.
• Frontend: full vitest suite, including the new composable spec and the reworked store and page specs; phpcs, phpstan, eslint, and stylelint clean.
• Live: cursor-walked all three endpoints on the dev wiki (23/23 Schemas, no duplicates or losses).

Manual Browser Check

1. Open Special:Schemas on a wiki with more than 10 Schemas (the demo seed has 23).
2. The table shows 10 rows with "Showing results 1–10 of many"; First, Previous, and Last are disabled, Next is enabled.
3. Click Next to the last page: intermediate pages read "of many"; the final page shows the exact total (for the demo seed, "21–23 of 23") and Next disables.
4. Click Previous and First: the earlier pages render the same rows again.
5. On page 2, switch the page size to 20: the table shows the rows from row 11 onward and the label stays aligned (it does not jump back to row 1).
6. Repeat steps 1–3 briefly on Special:Layouts and Special:Mappings (short single pages: "Showing the last N results", Next disabled).
7. The browser console shows no errors throughout.

_{AI-authored — Claude Code, Fable 5 (xhigh); asked to implement #1062 by @alistair3149, redirected once (the first-approved accurate-readable-total fix became cursor pagination after a scale discussion, with the contract approved before the rework) plus a requested mid-run review and browser smoke test; diff not yet human-reviewed; TDD (tests seen failing first; denial and pager-flip tests sabotage-checked), independently AI-reviewed with findings applied, PHPUnit/vitest/phpcs/phpstan/eslint green locally, browser-smoke-tested on the dev wiki, CI green.}