fix(api): paginate calls deterministically through tied timestamps

[sam-bretz]

What Changed

MET-536: make OSS /v1/calls traverse page-ending timestamp ties completely, using the unique database call identity rather than trace IDs. First OSS PR in P-MET-28, targets main at 323fd3fbdbc84460b6bc63a8b1800e3e402f42e3.

How It Works

Add opaque cursor and page:{next_cursor,has_more,limit}, retaining items unchanged. Order by (ts desc,id desc) with tuple continuation and bounded limit+1 lookahead. Cursor binds the OSS profile and environment/untagged/route/function filters; bearer auth still applies. Invalid/mismatched cursors and cursor+before return 400 before DB access. Preserve legacy timestamp-only before; document migration and rollback limits.

Coordinate with internal MET-536 / PR #999, based on MET-535 / internal PR #998. They share semantics but retain separate auth/profile scopes. No cross-repository Git ancestry or runtime dependency. Deploy additive servers before migrating paginating clients. No core/pricing, ingest transport or dashboard code changes.

QA Overview

• Canonical isolated dev install: uv pip install --python /private/tmp/met536-oss-venv/bin/python -e './core[dev]' -e './server[dev]'.
• MG_TEST_DATABASE_URL=<isolated disposable DB> /private/tmp/met536-oss-venv/bin/python -m pytest -q core/tests server/tests: 859 passed. New cursor/filter focused suite: 16 passed. Changed-file Ruff 0.15.21 and diff checks passed.
• Fresh headless Claude actual four-file diff review: no actionable findings.
• Canonical Compose production build from current source, unique project mg-met536-oss-6d3f95a3, temporary loopback port override. Native synthetic ingest + real HTTP/DB: nine expected calls over five pages, seven tied timestamps with repeated trace IDs; route/function/environment distractors excluded; four invalid cursor/filter combinations return 400; legacy before returns only older call.
• Shared measurement window 2026-10-03 01:20:59.139–01:20:59.213 UTC. Internal counterpart's fresh launch-scoped metrics record six 200 and four 400. OSS has no existing operational metrics exporter; no OSS metrics claim.
• Actual SDK testbench poll_rows at source 2ad59c449ee36f48ea0ddd6c092d81af564aa7c4, file SHA256 0ef2c8827d40f36dedc1117a448adbb43ea4c9888dc51c470e87b5fe7e883275, reads six expected synthetic rows with additive metadata. Zero provider calls. Existing OSS function detail consumes items.
• No performance, installed-release, deployment or paid-provider validation claim. Draft remains unmerged.