GET a repository's branches answers `{ items, next_cursor }`, and every test that reads it is updated #5060

Intent: a client reads the branches list the same way it reads every other list. This replaces half of #5041, which failed its check twice because two origins tests still read the bare array.

Done:

• [ ] GET /api/v1/repos/:owner/:name/branches (src/http/api.ts, near line 2743) answers { items, next_cursor }, with limit (default 50, max 200) and cursor checked the way the issue list checks them; a bad limit gets a 422 and a bad cursor gets invalid_cursor
• [ ] the order, permission and filter stay exactly as they are today
• [ ] tests: the shape, paging with limit and next_cursor to the end, and a bad limit refused
• [ ] every reader in src/ is updated: src/http/mcp.ts, src/tui (refs/workspace), src/web/client.ts, and anything else grep -rn '/branches' src finds that reads this API
• [ ] every test that reads the bare array is updated, including test/origins.test.ts:406 and test/origins-security-push.test.ts:364. Run every file grep -rln 'repos/[^\"]*/branches' test lists, at least: api-branches-timing, origins, origins-security-push, origins-reconnect, read-api, parity, branches, fork-flow, sealed-git, run-token, edits, edits-security, push-through, web-workflows

Leave alone: src/origins/providers/* read GitHub's and Forgejo's own APIs, not this one, and test/fake-origin.ts is that fake. The pull says the shape changed.