feat(api): paginate backend list endpoints

[woahwhattheheck]

Fixes #546

What changed

• validate employee-list page, limit, sort, and order with defaults 1 / 20 and a maximum limit of 100

• keep employee filtering and SQL LIMIT / OFFSET, with sorting restricted to an allowlist of real columns

• validate payroll transaction pagination and canonical sort / order parameters while preserving the existing sortBy / sortOrder aliases

• propagate validated sort/order through employee, batch, and memo service list paths

• put /payroll/employees/:employeeId, /payroll/batches/:batchId, and /payroll/search/memo on the same page=1 / limit=20 / max=100 route validation contract and return totalPages

• return totalPages alongside existing page, limit, and total pagination metadata

• add audit-log sort / order, safe SQL column mapping, and the missing limit response field

• preserve the tenant/filter-matched total on empty out-of-range employee pages;

• use the same detail-row predicates for audit counts and results;

• retain PostgreSQL parameter placeholders for employee paging and employee/asset audit bindings.

Boundaries

• no cursor pagination
• no global pagination-helper change; aggregation/report callers that intentionally request larger batches remain unchanged
• preserve payment execution and tenant isolation; align audit count/data with the intended employee/asset detail-row filters and preserve response record shape

Validation

• Current carrier head: d2c447736d28cb5bd4d5602458c8011be5f54218 — 14 commits, 8 issue-scoped files.
• The focused source execution recorded for d2c44773 passed both corrected service bodies: contiguous PostgreSQL bind indices, expected arguments, pagination metadata, and audit results. This was a checked query double, not a live PostgreSQL run or a repository suite; it has not been rerun.
• Exact-head build run 37753520851 and secrets run 37753522107 completed as failure with 0 jobs created. No hosted build/runtime green result is established.

Contribution and payment

The existing /claim #546 and original contributor/payee @woahwhattheheck remain in place. I am claiming this delivered contribution and requesting the applicable GrantFox Third Campaign payment. Please confirm eligibility, assignment, the reward amount, and the payout method and timing. Application, acceptance, award, and settlement are separate decisions.

[woahwhattheheck]

/claim #546

Existing issue claim: #546 (comment)

Original contributor and claimant/payee: @woahwhattheheck. Please evaluate PR #709 under the issue's existing GrantFox OSS / Third Campaign bounty route. Current carrier head: d2c447736d28cb5bd4d5602458c8011be5f54218.