feat(content): add filtered keyset pagination

[Jess Sullivan (Jesssullivan)]

Outcome

Adds one additive package-owned listing API for app-supplied eligibility predicates without changing legacy loadUserContent behavior.

API

loadUserContentPage(handle, options):

• applies the caller predicate before retaining the requested page;
• counts exact totalItems in the same scan without materializing an unbounded eligible result;
• defaults to 20 items and accepts only a finite page size from 1 through 100;
• uses a versioned base64url keyset cursor and rejects encoded cursors longer than 4096 characters before allocation;
• deterministically deduplicates the logical type/author/slug identity before eligibility/count/page so .md/.mdx twins cannot disappear at a boundary;
• strictly rejects malformed cursors, date bounds, and invalid limits;
• documents live-keyset rather than snapshot-isolated semantics.

The legacy loader remains exported and behavior-compatible. The facade and factory expose the new additive API.

Lean proof

• Five existing files only.
• Existing tests/content-loader.test.ts and existing //:test target only.
• No shell test, new target, BUILD/MODULE/package-version, release, BCR, or consumer-pin change.
• Compact coverage: 126 held-back records before eligible records, exact totals, keyset continuation, tied insertion after the cursor, equal timestamps, logical .md/.mdx duplicate boundary, min/max bounds, malformed/oversized cursor, invalid/unbounded limits, the accepted 100-item maximum, empty/all-held-back, and legacy loader behavior.
• git diff --check: pass.
• Independent final code review: LAND.
• Local Bazel/test execution was not used as landing authority. Exact-head remote proof is asynchronous.

Authority boundary

This is the standalone tinyland-content source tranche for TIN-3704. It does not publish a release, mutate the Bazel registry, or update tinyland.dev. Those remain separate reviewed steps. Only after release/BCR/consumer adoption should tinyland.dev remove its temporary Number.MAX_SAFE_INTEGER outbox scan.

Base: 6f9445b3ee91f0841392a59e57f7a144d61ed0ae
Head: 2ba2ba6ea1924a63f7fa8d3d4f478285073789f4

Linear: TIN-3704

[linear-code]

TIN-3704