cloud-vault/document: add keyset cursor-based pagination

[biglyan]

Summary

Adds cursor-based (keyset) pagination to the document list endpoint as a complement to the existing offset-based pagination — the last strongly-recommended item from the cloud-vault feature-completeness review.

• ListQuery.AfterID: pass the next_cursor value from a previous response to page forward without offset scanning cost.
• ListResult.NextCursor / HasMore: populated when more pages exist; empty/false on the last page.
• Stable ordering: ORDER BY clauses gain a secondary , id <dir> sort so the cursor position is unambiguous when the primary sort column ties.
• Efficient: cursor mode skips the COUNT(*) query and uses keyset WHERE conditions (no OFFSET scan). Offset-based pagination is unchanged and still works.
• Backward compatible: AfterID is optional; existing callers that use limit/offset see no change in behavior.

API

GET /api/v1/documents?limit=50              → first page (offset mode, total included)
GET /api/v1/documents?limit=50&after_id=<cursor>   → next page (cursor mode, total=-1)

Response adds two new fields:

{
  "data": {
    "items": [...],
    "total": -1,
    "limit": 50,
    "offset": 0,
    "next_cursor": "<last-item-id>",
    "has_more": true
  }
}

Test plan

• TestSQLiteRepository_List_KeysetCursor: 5 docs, 3 cursor-based pages, no overlap, full coverage
• TestBuildOrderClause_*: updated to expect secondary id sort
• All existing document tests pass (go test ./internal/document/...)
• Full module test suite green

https://claude.ai/code/session_014xk5ygPiuUm2JNZMbFjHNy

---

Generated by Claude Code

[github-actions]

Code Coverage Report ✅

Total coverage: 74.1% (gate: ≥70%)

15 packages with lowest coverage

github.com/spcent/plumego/core/lifecycle.go:18:					Run						0.0%
github.com/spcent/plumego/internal/checks/agent-workflow/main.go:13:		main						0.0%
github.com/spcent/plumego/internal/checks/agent-workflow/main.go:31:		workflowViolations				0.0%
github.com/spcent/plumego/internal/checks/agent-workflow/main.go:158:		requiredControlPlaneSpecViolations		0.0%
github.com/spcent/plumego/internal/checks/agent-workflow/main.go:383:		failf						0.0%
github.com/spcent/plumego/internal/checks/checkutil/checkutil.go:552:		FindReferenceXImports				0.0%
github.com/spcent/plumego/internal/checks/checkutil/checkutil.go:1072:		FindTaskRoutingCoverageViolations		0.0%
github.com/spcent/plumego/internal/checks/checkutil/checkutil.go:1095:		FindExtensionTaxonomyCoverageViolations		0.0%
github.com/spcent/plumego/internal/checks/checkutil/checkutil.go:1224:		hasHandlerLikeParam				0.0%
github.com/spcent/plumego/internal/checks/checkutil/checkutil.go:1255:		hasStringParam					0.0%
github.com/spcent/plumego/internal/checks/checkutil/checkutil.go:1436:		isDisallowedImport				0.0%
github.com/spcent/plumego/internal/checks/checkutil/checkutil.go:1459:		ReadModulePublicEntrypoints			0.0%
github.com/spcent/plumego/internal/checks/checkutil/controlplane.go:386:	ReadTaskRouting					0.0%
github.com/spcent/plumego/internal/checks/checkutil/controlplane.go:474:	matchesForbiddenImportPattern			0.0%
github.com/spcent/plumego/internal/checks/checkutil/guidance.go:10:		FormatViolations				0.0%

Full HTML report available as the coverage-report workflow artifact (30-day retention).