refactor(pagination): hoist cursor codec to utils/ for cross-domain reuse

The keyset cursor codec was asset-namespaced (app/assets/services/cursor.py)
but the wire format and encode/decode logic are domain-agnostic. Move it to
utils/cursor.py so the jobs endpoint can share one codec instead of importing
across domains or duplicating it.

app/assets/api/routes.py

@@ -39,7 +39,7 @@ from app.assets.services import (
     update_asset_metadata,
     upload_from_temp_path,
 )
-from app.assets.services.cursor import InvalidCursorError
+from utils.cursor import InvalidCursorError
 from app.assets.services.tagging import list_tag_histogram
 
 ROUTES = web.RouteTableDef()

app/assets/services/asset_management.py

@@ -4,7 +4,7 @@ import os
 from datetime import timezone
 from typing import Sequence
 
-from app.assets.services.cursor import (
+from utils.cursor import (
     CursorPayload,
     InvalidCursorError,
     decode_cursor,

tests-unit/assets_test/services/test_cursor.py

@@ -1,4 +1,4 @@
-"""Tests for app.assets.services.cursor.
+"""Tests for utils.cursor.
 
 Cursors are opaque tokens internal to this server — these tests cover
 round-tripping, validation, and length caps, not any particular wire
@@ -11,7 +11,7 @@ from datetime import datetime, timedelta, timezone
 
 import pytest
 
-from app.assets.services.cursor import (
+from utils.cursor import (
     MAX_CURSOR_ID_LENGTH,
     MAX_CURSOR_VALUE_LENGTH,
     MAX_ENCODED_CURSOR_LENGTH,

utils/cursor.py

@@ -1,4 +1,4 @@
-"""Opaque keyset-pagination cursor for /api/assets.
+"""Opaque keyset-pagination cursor shared by /api/assets and /api/jobs.
 
 Payload JSON uses short keys to keep the encoded length small: