fix(pagination): enforce bounded page size on sensitive list/export endpoints (SB-C02)

[groupsky]

SB-C02 · Unbounded pagination (Critical)

Problem

List/export endpoints let a single authenticated request pull an unbounded number of full records — sensitive-species exact coordinates, confidential records, and observer PII included. The -1 "unlimited" sentinel mapped to 20,000/50,000 (or truly unbounded), positive limits were honored verbatim with no ceiling, and un-floored Math.min caps let limit=-1 slip past intended limits (even dropping the LIMIT clause entirely on user:list).

Fix

Centralised, floor-then-cap pagination with hard server-side ceilings that apply to every role and input:

• config/pagination.js — formListMax 1000, formExportMax 50000, userListMax 5000, zoneListMax 50000, alertListMax 500, publicMax 1000.
• helpers/pagination.js — resolveLimit (-1/negative → bounded max, never unbounded or the accidental →1 collapse), clampLimit (floor-then-cap), clampOffset.
• initializers/formMethods.js — <form>:list → formListMax; <form>:export → formExportMax threaded via a new opts.max; public-context clamp preserved.
• initializers/formActions.js — strip limit/offset before count() so pagination totals stay true.
• actions/user.js, actions/zones.js (was fully unbounded — no limit applied), actions/suspiciousActivityAlerts.js — now bounded.
• helpers/auditHelpers.js — validatePagination delegates to the shared helpers (dedup; existing tests are the regression guard).

Reference-data endpoints (helpers/paging.js consumers: location:*, ebp:speciesList, nomenclature:*) are intentionally out of scope — clients rely on their full-list -1 default; they need a separate client-pagination / static-JSON / permissioned-storage migration.

Testing

• New Postgres-only tests (__tests__/helpers/pagination.js, __tests__/actions/pagination.js): helper units + list/export/user/zone/alert clamp and count-integrity assertions, including the -1 → max (not 1, not unbounded) property.
• Full suite run on SQLite + Postgres. All pagination-affected suites pass; the only failures are pre-existing/environmental and unrelated to this change: test/banner.js (locale/banner rendering, fails identically on master) and __tests__/initializers/filestorage.js (heif-convert binary absent locally; CI provides it).
• standard lint clean.

Android is unaffected (forms are POST; no user:list). Exports remain bounded (50000 = prior admin ceiling); chunking/approval of very large exports is deferred to the SB-C05/SB-C03 work.