Opaque cursors must not redefine trusted server time

Adversarial review found a reusable pagination rule: if a cursor embeds readAt and is only integrity-bound with a caller-recomputable hash, parse it for pagination state but never reuse it as the trusted server clock before validating readAt <= current server time. Otherwise a forged cursor can make an end-omitted historical query accept a future window. Source provenance: local uncommitted Sherlock review, apps/dashboard/src/server/mcp-query-source.js queryWindow (lines 69-79), cursor parsing/fingerprint (90-152), and fetchSessions (737-766), verified with an in-memory stub on 2026-09-03. No private data was accessed.