The boards list and the caller's board pins answer `{ items, next_cursor }` #5215

Intent: a client reads every list the same way; today these answer a bare array.

Done:

• [ ] GET /api/v1/boards and GET /api/v1/boards/pins answer { items, next_cursor } as the header of src/http/api.ts promises for lists, with limit (default 50, max 200) and cursor validated like the issue list's, and a bad limit a 422
• [ ] tests for each: the shape, paging with limit and next_cursor to the end, and a bad limit refused
• [ ] every caller in src/ (the terminal UI, client.ts, mcp.ts, pages) and test/ that read the bare array reads items; the pull says the shape changed

Keep each route's permission and filter exactly as they are; only the shape changes. Other issues change other lists in src/http/api.ts in parallel, so touch only the routes named here.

Fresh: replaces #5045. Both tries failed on the same unrelated test (the green agent pull and its reviewer, #5160). This waits for that fix.

duplicate of #5045