Refacto load all functions

Unbounded LoadAll* loaders materialised an entire result set in one
query with no ceiling. A table that is small in development can grow
without bound in production, so these loaders were a latent memory
and query-time hazard.

Remove the LoadAll* methods from pkg/coredata and walk the cursor-
paginated LoadBy* siblings instead through a shared page.LoadAll
helper. The helper advances a MaxCursorSize forward cursor until the
result set is exhausted and concatenates the pages. It caps a single
call at MaxLoadAllPages (20) batches of 500 rows and errors past that
rather than materialising an unbounded set, so a runaway caller fails
loudly instead of exhausting memory.

Callers that genuinely need every row now express that explicitly,
and the coredata load-naming rule and docs are updated to discourage
new unbounded loaders.

Signed-off-by: Sacha Al Himdani <sacha@probo.com>

pkg/coredata/organization.go

@@ -255,11 +255,12 @@ WHERE
 	return nil
 }
 
-func (o *Organizations) LoadAllByIdentityIDWithPendingInvitation(
+func (o *Organizations) LoadByIdentityIDWithPendingInvitation(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 	identityID gid.GID,
+	cursor *page.Cursor[OrganizationOrderField],
 ) error {
 	q := `
 WITH invited_org AS (
@@ -292,13 +293,14 @@ INNER JOIN
 	invited_org ON organizations.id = invited_org.organization_id
 WHERE
 	%s
-ORDER BY name ASC
+	AND %s
 `
 
-	q = fmt.Sprintf(q, scope.SQLFragment())
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
 
 	args := pgx.StrictNamedArgs{"identity_id": identityID}
 	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {