fix(entities): count and page only authorized records

[rrrodzilla]

Entity list counts and offsets previously ran before record authorization. A page containing denied records could be empty while reporting a nonzero total, and readable records on later storage pages were skipped. Apply the existing operator record policy and Cedar checks before counting and paging for both GET lists and POST queries. Totals now count readable matches, and offsets skip readable records. No authorization rules or owner semantics change.

Scan complete candidate rows in batches of 256, retain the requested readable page, and stop early when totals are disabled. Field projection remains after authorization. Document the full-scan cost of exact totals, SQL Server's existing internal table scans, and the absence of a shared database snapshot across batches.

Validation: the committed dependency lockfile passed 720 integration tests (seven skipped) and all-target clippy with warnings denied for the integration crate and PostgreSQL CLI. New HTTP tests cover mixed and all-denied filters, beyond-end offsets, field projection, and a 520-row cross-batch case with both Cedar and an operator record policy. Independent PostgreSQL acceptance passed all 11 cases on the patched CLI; the prior official binary failed those same cases against the same database.

Fixes #152.