Clamp pagination size in page.NewCursor

Enforce minimum (25) and maximum (100) bounds on cursor size to prevent negative values or excessively large page sizes. All three API surfaces (GraphQL, MCP, CLI) funnel through NewCursor, so the fix belongs here.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/page/cursor.go

@@ -36,14 +36,17 @@ type (
 
 const (
 	DefaultCursorSize = 25
+	MaxCursorSize     = 100
 
 	Tail Position = "TAIL"
 	Head Position = "HEAD"
 )
 
 func NewCursor[T OrderField](size int, from *CursorKey, pos Position, orderBy OrderBy[T]) *Cursor[T] {
-	if size == 0 {
+	if size <= 0 {
 		size = DefaultCursorSize
+	} else if size > MaxCursorSize {
+		size = MaxCursorSize
 	}
 
 	return &Cursor[T]{