fix(repo,service): SCALE-002 — push pagination into SQL for target/issuer/team/agent_group

Sprint 2 unified-master-audit closure. Pre-fix four service List
endpoints (target, issuer, team, agent_group) called repoFoo.List(ctx)
to fetch the full table then sliced in memory:

    rows, _ := s.repo.List(ctx)
    total := int64(len(rows))
    start := (page - 1) * perPage
    end := start + perPage
    return rows[start:end], total, nil

This page-sliced in memory pattern marshals every row per request —
fine on small fleets but unacceptable for multi-tenant or large-fleet
deploys. The agent_group case was worse — the service explicitly
ignored page/perPage and returned the entire slice.

Fix:
  - New ListPaginated(ctx, limit, offset) method on each of the four
    repositories. Postgres implementations push LIMIT + OFFSET into
    the SQL plus a SELECT COUNT(*) for the total. Mirrors the cursor
    pattern already in internal/repository/postgres/certificate.go.
  - Each ListPaginated normalises limit≤0→50 and offset<0→0,
    matching the service-layer defaults that already existed.
  - Repository interfaces grow the new method so adapters stay
    swappable.
  - Service List methods now call repoFoo.ListPaginated(ctx, perPage,
    (page-1)*perPage) directly — no more memory-slice.
  - AgentGroupService.ListAgentGroups closes the Bundle E / Audit
    L-020 'page/perPage unused' gap.

Test changes:
  - sliceWindow generic helper in testutil_test.go mirrors the SQL
    LIMIT/OFFSET semantics for in-memory mocks.
  - Six mock implementers (lifecycle_test, testutil_test x2,
    agent_group_test, team_test) gain ListPaginated methods.
  - TestTeamService_List_SCALE002_PaginationPropagatesToRepo pins
    the page=2, perPage=3 → 3 rows of 10 invariant.

Closes SCALE-002.

internal/repository/interfaces.go

@@ -210,6 +210,11 @@ type OCSPResponderRepository interface {
 type IssuerRepository interface {
 	// List returns all issuers, optionally filtered.
 	List(ctx context.Context) ([]*domain.Issuer, error)
+	// ListPaginated returns a window of issuers (sorted by created_at DESC)
+	// plus the total row count. SCALE-002 closure (Sprint 2, 2026-05-16) —
+	// pushes pagination into the SQL layer so admin pages don't marshal
+	// the full table per request.
+	ListPaginated(ctx context.Context, limit, offset int) ([]*domain.Issuer, int64, error)
 	// Get retrieves an issuer by ID.
 	Get(ctx context.Context, id string) (*domain.Issuer, error)
 	// Create stores a new issuer.
@@ -227,6 +232,10 @@ type IssuerRepository interface {
 type TargetRepository interface {
 	// List returns all targets, optionally filtered.
 	List(ctx context.Context) ([]*domain.DeploymentTarget, error)
+	// ListPaginated returns a window of deployment targets (sorted by
+	// created_at DESC) plus the total row count. SCALE-002 closure
+	// (Sprint 2, 2026-05-16).
+	ListPaginated(ctx context.Context, limit, offset int) ([]*domain.DeploymentTarget, int64, error)
 	// Get retrieves a target by ID.
 	Get(ctx context.Context, id string) (*domain.DeploymentTarget, error)
 	// Create stores a new target.
@@ -550,6 +559,9 @@ type NotificationRepository interface {
 type TeamRepository interface {
 	// List returns all teams.
 	List(ctx context.Context) ([]*domain.Team, error)
+	// ListPaginated returns a window of teams (sorted by created_at DESC)
+	// plus the total row count. SCALE-002 closure (Sprint 2, 2026-05-16).
+	ListPaginated(ctx context.Context, limit, offset int) ([]*domain.Team, int64, error)
 	// Get retrieves a team by ID.
 	Get(ctx context.Context, id string) (*domain.Team, error)
 	// Create stores a new team.
@@ -578,6 +590,9 @@ type CertificateProfileRepository interface {
 type AgentGroupRepository interface {
 	// List returns all agent groups.
 	List(ctx context.Context) ([]*domain.AgentGroup, error)
+	// ListPaginated returns a window of agent groups (sorted by name)
+	// plus the total row count. SCALE-002 closure (Sprint 2, 2026-05-16).
+	ListPaginated(ctx context.Context, limit, offset int) ([]*domain.AgentGroup, int64, error)
 	// Get retrieves an agent group by ID.
 	Get(ctx context.Context, id string) (*domain.AgentGroup, error)
 	// Create stores a new agent group.