standalone cursor codec

[Jumongweb]

Closes #351

Summary

• Add @guildpass/cursor-codec as a standalone workspace package for opaque API pagination cursors.
• Encode deterministic v1 cursor payloads as URL-safe payload.signature tokens.
• Protect cursors with externally supplied HMAC-SHA256 secrets and timing-safe signature verification.
• Return typed decode failures for malformed, oversized, tampered, invalid, and unsupported-version cursors.

Tests

• pnpm typecheck
• pnpm build
• pnpm test

[Lakes41]

This PR cannot be merged automatically because it has merge conflicts.

Please update the branch with the latest base branch and resolve the conflicts.

After the conflicts are resolved and checks pass, the automation can review it again.

[Lakes41]

This PR cannot be merged automatically because one or more workflow checks failed.

Please review the failed checks, push a fix, and wait for the workflows to pass.

After the checks pass and there are no merge conflicts, the automation can review it again.