Opaque cursors must not redefine trusted server time
Adversarial review found a reusable pagination rule: if a cursor embeds readAt and is only integrity-bound with a caller-recomputable hash, parse it for pagination state but never reuse it as the trusted server clock before validating readAt <= current server time. Otherwise a fo…