The caller's own lists answer `{ items, next_cursor }`: tokens, origins and origin apps #4841

Intent: a client reads every list the same way. Today these three answer a bare array.

Done:

• [ ] GET /api/v1/tokens, GET /api/v1/user/origins and GET /api/v1/user/origin-apps answer the shape below
• [ ] tests for each: the shape, paging with limit and next_cursor to the end, and a bad limit refused

Shape: { items, next_cursor } as the header of src/http/api.ts promises for lists, with limit (default 50, max 200) and cursor validated like the issue list's, and a bad limit a 422. Update every caller in src/ (the terminal UI, client.ts, mcp.ts) and test/ that read the bare array, and say the change in the pull. Keep each route's permission and filter exactly as they are; only the shape changes. Other issues change other lists in src/http/api.ts in parallel, so touch only the routes named here.

Parked by the crew: the check failed ("a burst of errors: the board says so, one page, no more; clear for five minutes: one Recovered, all fine") and the decider saw no point in another try (pull #4861 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("a reader's issue on an autonomous public repository > the planner's link and a writer's label adopt nothing; a writer's link or assignment does, and it flows") and the decider saw no point in another try (pull #5142 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("a burst of errors: the board says so, one page, no more; clear for five minutes: one Recovered, all fine") and the decider saw no point in another try (pull #4861 closed)
2. the check failed ("a reader's issue on an autonomous public repository > the planner's link and a writer's label adopt nothing; a writer's link or assignment does, and it flows") and the decider saw no point in another try (pull #5142 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Replaced by #5211: same scope, but it waits for fixes to the two unrelated tests that failed its tries (#5199, #5107).

Closed as dropped, not split: the forge refused a one-for-one split here. Nothing is lost. #5211 carries this scope word for word, under the same pillar, and waits for the fixes to the unrelated red tests.