A repository's reports and milestones answer `{ items, next_cursor }` #5044

Intent: a client reads every list the same way; today these answer a bare array.

Done:

• [ ] GET {REPO}/reports and GET {REPO}/milestones answer { items, next_cursor } as the header of src/http/api.ts promises for lists, with limit (default 50, max 200) and cursor validated like the issue list's, and a bad limit a 422
• [ ] tests for each: the shape, paging with limit and next_cursor to the end, and a bad limit refused
• [ ] every caller in src/ (the terminal UI, client.ts, mcp.ts, pages) and test/ that read the bare array reads items; the pull says the shape changed

A report's text stays marked untrusted exactly as today. Keep each route's permission and filter exactly as they are; only the shape changes. Other issues change other lists in src/http/api.ts in parallel, so touch only the routes named here.

Split: it hit its daily run cap. #5223 changes the reports list and #5224 the milestones list, one route each, so each fits one run. Both can start now.