refactor(repository): deepen versioned cursor pagination behind shared helpers

[allisson]

Summary

Collapses the hand-rolled latest-version cursor JOIN and dry-run hard-delete SQL that the secrets, transit, and tokenization key repositories each copy-pasted, behind two helpers in internal/database:

• ListLatestCursor[T] — owns the two-branch latest-version JOIN, row iteration, and empty-slice normalization; callers supply the table, key column, SELECT list, and a row scan callback.
• HardDeleteOlderThan — owns the dry-run count-vs-delete.

Each key repository keeps its trivial Create / GetByKey / GetByKeyAndVersion / Delete and delegates ListCursor (and HardDelete where the shape matches) to the seam. The tokenization TokenRepository.HardDelete is intentionally left as-is — it has an extra child-token cleanup step that would require a pre-delete hook.

Also deletes the unused offset-pagination List method on the secrets repository (not on the interface, no callers).

Net: 311 lines removed, 199 added.

Validation

• go build ./... — clean
• go vet ./... — clean
• golangci-lint run --fix — clean
• go test ./... — all unit tests pass
• go test -tags=integration -p 1 ./... against Postgres — all integration tests pass

Note: without -p 1 the three repository packages race on the shared test DB and drop each other's schema mid-test, producing spurious FK failures — reproduced identically on the original code, so unrelated to this change.

Changelog

Internal refactor with no API change — recorded under Unreleased → Changed.