fix(auth): enforce deterministic, scope-safe cursor pagination in <endpoint> - #1684

Closes #1646

Summary

Problem

<What was previously undefined or unsafe: e.g. cursor not tied to a stable sort key,
no explicit page-limit validation, end-of-stream signaled ambiguously, or concurrent
inserts able to shift results across a page boundary causing skip/duplicate/leak.>

Design & Invariants

• Ordering key: <field(s)>, tie-broken by <e.g. id> for determinism
• Cursor encoding: <opaque token format, what it encodes, how it's validated>
• Page limit: <default, max, rejection behavior above max>
• End-of-stream: <explicit signal, e.g. null next_cursor / has_more: false>
• Scope safety: cursor cannot be used to read outside the requesting user's/session's
  authorized scope

Changes

• <path>:
• <path>:

Failure Behavior & Compatibility

• Invalid/malformed/expired cursor → rejected with <error type/shape>, no partial results returned
• Public API/response shape: <unchanged | changed as follows: ...>
• Migration/rollback: <none required | steps>

Test Evidence

Cases tested against actual integration boundary:

• empty result set
• single-page result (count < limit)
• exact page-boundary result (count == limit)
• concurrent insert during pagination (no skip/duplicate across pages)
• invalid/tampered/expired cursor rejected
• large result set (multi-page traversal returns full, non-duplicated set)

Concurrency/replay:

• repeated request with same cursor is idempotent (no state mutation, same page)
• stale/expired session token rejected before any data is returned
• out-of-scope cursor (e.g. another user's) rejected, not silently scoped-down

Commands Run

```
<formatter command + result>
<lint command + result>
<type/build command + result>
<full test suite command + result>
<security/contract check command + result, if applicable>
```

Security / Correctness Note

<1 short paragraph: what this guarantees (no cross-scope leakage, deterministic
ordering under concurrent writes), what it does not cover, any residual limitation
or assumption — e.g. behavior under schema migration, cursor lifetime.>

Scope Confirmation

• No unrelated refactors
• No formatting-only changes bundled in
• No generated artifacts or secrets included
• No disabled checks