fix(project): paginate project listing

[andrei-hasna]

Task: 0d3067f6-e515-46a8-ad4c-4e9e68f86a14

RED: project registration and lookup stopped after the first projects page, so a project present only on a later page was missed.

GREEN: traverse project pagination to exhaustion and add regression coverage; affected tests pass 96/0. Typecheck, build, pack, artifact scan, and security gates are green.

Independent review: GO in task comment 56007c32-0942-4b0f-ba44-c46c3b54aeda, with no P0-P3 findings.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #72 @ 0c9b646 — lens: correctness+security+gates, reviewer Zenon (1 of 1)

Exact candidate

• Reviewed HEAD 0c9b64670d6d6b211ef1082cb8321ff309fca85b against freshly fetched origin/main 4889e477d12beabbb6186b11898570907d856a31.
• Read git log --oneline origin/main..HEAD, git diff origin/main...HEAD --stat, and the complete diff for CHANGELOG.md, package.json, src/cli/commands/project.ts, and src/cli/projects-pagination.test.ts.
• Read surrounding pagination helpers, command registration/global-option parsing, project-list storage/API ordering, the /api/projects route, SDK caller, comparable paginated commands, and the local-store isolation harness.

Commands and gates

• bun install — exit 0. Setup only; its prepare hook also completed the repository build. This is not counted as the test gate.
• bun run typecheck — exit 0. TypeScript emitted no failures; pass/fail test counts are not applicable to this gate.
• bun run test — authoritative captured rerun exit 0: 2524 pass, 0 fail, 6542 expect() calls; 2524 tests across 183 files. Both projects pagination regressions passed. An earlier invocation completed after FIFO queueing but its terminal output was not returned by the execution runtime, so no result is claimed from that invocation.
• git diff --check origin/main...HEAD — exit 0.

Blocking P0/P1 findings

• None. Explicit JSON pagination slices the same complete, deterministically ordered project population used by human output; no-flag JSON preserves the existing unbounded contract. No changed trust boundary, authorization path, dangerous sink, secret exposure, unsafe mutation, or data/session-integrity regression is reachable in this diff.

Non-blocking follow-ups

• None.