fix(repo,service): SCALE-002 — push pagination into SQL for target/issuer/team/agent_group

Sprint 2 unified-master-audit closure. Pre-fix four service List
endpoints (target, issuer, team, agent_group) called repoFoo.List(ctx)
to fetch the full table then sliced in memory:

    rows, _ := s.repo.List(ctx)
    total := int64(len(rows))
    start := (page - 1) * perPage
    end := start + perPage
    return rows[start:end], total, nil

This page-sliced in memory pattern marshals every row per request —
fine on small fleets but unacceptable for multi-tenant or large-fleet
deploys. The agent_group case was worse — the service explicitly
ignored page/perPage and returned the entire slice.

Fix:
  - New ListPaginated(ctx, limit, offset) method on each of the four
    repositories. Postgres implementations push LIMIT + OFFSET into
    the SQL plus a SELECT COUNT(*) for the total. Mirrors the cursor
    pattern already in internal/repository/postgres/certificate.go.
  - Each ListPaginated normalises limit≤0→50 and offset<0→0,
    matching the service-layer defaults that already existed.
  - Repository interfaces grow the new method so adapters stay
    swappable.
  - Service List methods now call repoFoo.ListPaginated(ctx, perPage,
    (page-1)*perPage) directly — no more memory-slice.
  - AgentGroupService.ListAgentGroups closes the Bundle E / Audit
    L-020 'page/perPage unused' gap.

Test changes:
  - sliceWindow generic helper in testutil_test.go mirrors the SQL
    LIMIT/OFFSET semantics for in-memory mocks.
  - Six mock implementers (lifecycle_test, testutil_test x2,
    agent_group_test, team_test) gain ListPaginated methods.
  - TestTeamService_List_SCALE002_PaginationPropagatesToRepo pins
    the page=2, perPage=3 → 3 rows of 10 invariant.

Closes SCALE-002.

internal/service/testutil_test.go

@@ -15,6 +15,27 @@ import (
 
 var errNotFound = errors.New("not found")
 
+// sliceWindow is a tiny helper for the SCALE-002 mock ListPaginated
+// implementations. It mirrors the SQL LIMIT/OFFSET window over an
+// in-memory slice with the same normalisation as the postgres repos
+// (limit≤0 → return as-is; offset<0 → 0; out-of-range → empty).
+func sliceWindow[T any](all []T, limit, offset int) []T {
+	if offset < 0 {
+		offset = 0
+	}
+	if offset >= len(all) {
+		return nil
+	}
+	if limit <= 0 {
+		return all[offset:]
+	}
+	end := offset + limit
+	if end > len(all) {
+		end = len(all)
+	}
+	return all[offset:end]
+}
+
 // testEncryptionKey is a deterministic passphrase for unit tests that
 // exercise IssuerService/TargetService write paths. After the C-2 remediation
 // these services fail closed when no key is configured, so happy-path tests
@@ -1246,6 +1267,15 @@ func (m *mockTargetRepo) List(ctx context.Context) ([]*domain.DeploymentTarget,
 	return targets, nil
 }
 
+// ListPaginated mirrors the SQL-side window. SCALE-002 closure (Sprint 2).
+func (m *mockTargetRepo) ListPaginated(ctx context.Context, limit, offset int) ([]*domain.DeploymentTarget, int64, error) {
+	all, err := m.List(ctx)
+	if err != nil {
+		return nil, 0, err
+	}
+	return sliceWindow(all, limit, offset), int64(len(all)), nil
+}
+
 func (m *mockTargetRepo) Get(ctx context.Context, id string) (*domain.DeploymentTarget, error) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
@@ -1535,6 +1565,15 @@ func (m *mockIssuerRepository) List(ctx context.Context) ([]*domain.Issuer, erro
 	return issuers, nil
 }
 
+// ListPaginated mirrors the SQL-side window. SCALE-002 closure (Sprint 2).
+func (m *mockIssuerRepository) ListPaginated(ctx context.Context, limit, offset int) ([]*domain.Issuer, int64, error) {
+	all, err := m.List(ctx)
+	if err != nil {
+		return nil, 0, err
+	}
+	return sliceWindow(all, limit, offset), int64(len(all)), nil
+}
+
 func (m *mockIssuerRepository) Get(ctx context.Context, id string) (*domain.Issuer, error) {
 	if m.GetErr != nil {
 		return nil, m.GetErr