A repository's forks, labels and webhooks answer `{ items, next_cursor }` #4843

Intent: a client reads every list the same way, and a much-forked repository's forks come in pages. Today these three answer a bare array.

Done:

• [ ] GET /api/v1/repos/:owner/:name/forks, /labels and /hooks answer the shape below; forks keep visibleForks, and hooks keep their admin-only read and never show a secret
• [ ] tests for each: the shape, paging, a private fork not shown to a stranger, and a bad limit refused

Risk: #4752 (MCP hooks) may read the hooks list; if it has landed, update it here.

Shape: { items, next_cursor } as the header of src/http/api.ts promises for lists, with limit (default 50, max 200) and cursor validated like the issue list's, and a bad limit a 422. Update every caller in src/ (the terminal UI, client.ts, mcp.ts) and test/ that read the bare array, and say the change in the pull. Keep each route's permission and filter exactly as they are; only the shape changes. Other issues change other lists in src/http/api.ts in parallel, so touch only the routes named here.

Parked by the crew: the check stayed red through 2 automatic tries (pull #4853 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Closed: already done on main in 7cabc472 (pull #7049).