A repository's branches and tags answer `{ items, next_cursor }` #5041

Intent: a client reads every list the same way; today these answer a bare array.

Done:

• [ ] GET {REPO}/branches and GET {REPO}/tags answer { items, next_cursor } as the header of src/http/api.ts promises for lists, with limit (default 50, max 200) and cursor validated like the issue list's, and a bad limit a 422
• [ ] tests for each: the shape, paging with limit and next_cursor to the end, and a bad limit refused
• [ ] every caller in src/ (the terminal UI, client.ts, mcp.ts, pages) and test/ that read the bare array reads items; the pull says the shape changed

The order stays as today (tags newest first). Keep each route's permission and filter exactly as they are; only the shape changes. Other issues change other lists in src/http/api.ts in parallel, so touch only the routes named here.

Parked by the crew: the check failed ("origins: connecting, mirroring, writing through > mirroring creates the repo, fetches git, and imports the units") and the decider saw no point in another try (pull #5055 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("origins: connecting, mirroring, writing through > mirroring creates the repo, fetches git, and imports the units") and the decider saw no point in another try (pull #5058 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("origins: connecting, mirroring, writing through > mirroring creates the repo, fetches git, and imports the units") and the decider saw no point in another try (pull #5055 closed)
2. the check failed ("origins: connecting, mirroring, writing through > mirroring creates the repo, fetches git, and imports the units") and the decider saw no point in another try (pull #5058 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split into #5060 (branches) and #5061 (tags). Both tries failed for the same reason: test/origins.test.ts:406 and test/origins-security-push.test.ts:364 still read the bare branches array, and neither file was run before the push. Each new issue names every test file that reads its route, and says to leave src/origins/providers alone because they read GitHub and Forgejo, not this API.