GL-335: Consistent cursor pagination + fix OpenAPI list response contract

[discodone]

Review source

Round 14 (Gemini) — API Design 6/10, top blocker.

Problem

1. OpenAPI spec (docs/openapi.yaml) incorrectly documents list endpoints (GET /v1/grants etc.) as returning raw arrays. The implementation actually returns a GrantListResponse wrapper — the documented contract is wrong and misleading.
2. Pagination uses limit/offset, which is inefficient for large datasets. Cursor pagination is partially implemented (test_gl304_bigserial_pagination.py) but not consistently used or documented.

Fix

• Update OpenAPI spec so ALL list endpoints document the wrapper object (items + next_cursor + total or similar)
• Implement consistent cursor-based pagination across ALL list endpoints (grants, grant_requests, users, audit, webhooks, api-keys)
• Return next_cursor in every list response; deprecate offset (keep for one version with warning)
• Regenerate /api/openapi.json to match

Acceptance Criteria

• Every list endpoint returns {items, next_cursor, ...} wrapper
• OpenAPI spec matches implementation exactly (contract test passes)
• Cursor pagination works on all list endpoints
• mypy clean, ruff clean, tests >= baseline