The caller's own lists answer `{ items, next_cursor }`: tokens, origins and origin apps #5211

Intent: a client reads every list the same way. Today these three answer a bare array.

Done:

• [ ] GET /api/v1/tokens, GET /api/v1/user/origins and GET /api/v1/user/origin-apps answer the shape below
• [ ] tests for each: the shape, paging with limit and next_cursor to the end, and a bad limit refused

Shape: { items, next_cursor } as the header of src/http/api.ts promises for lists, with limit (default 50, max 200) and cursor validated like the issue list's, and a bad limit a 422. Update every caller in src/ (the terminal UI, client.ts, mcp.ts) and test/ that read the bare array, and say the change in the pull. Keep each route's permission and filter exactly as they are; only the shape changes. Other issues change other lists in src/http/api.ts in parallel, so touch only the routes named here.

Fresh: replaces #4841. Both tries failed on tests it never touched (the burst-of-errors board, #5107; the autonomy adoption test). This waits for those fixes so its check judges this change.

duplicate of #4841