Reject inbox pagination cursor minted under a different filter (CL-7206)

[TheGreatAxios]

Stacking

1 of 3 in a stack on packages/inbox/src/routes.ts: CL-7206 (this PR) → CL-7207 → CL-7208. Base branch is main; CL-7207 branches off this PR's tip.

Summary

@corbits/mailbox embeds the view/sort/filter a pagination cursor was minted under directly in the cursor, specifically so a caller can reject a cross-set replay — its own mount.ts route already performs this cross-check. packages/inbox/src/routes.ts's GET / decoded the cursor but never performed it, so paging ?group=action, then replaying that nextCursor under ?group=mention, returned a 200 seeking into the wrong result set — silently skipping every newer mention.

• Added packages/inbox/src/cursor.ts: cursorScopeMismatch(), a pure function reusing @corbits/mailbox's exported canonicalMailboxFilter and mirroring its mount.ts's exact error vocabulary ("cursor does not match inbox view/sort/filter"), so the two routes answer identically to the same condition.
• GET / now rejects a scope-mismatched cursor with 400 before any DB access, and pins sort: "date" as const on its listUserMailbox call explicitly (previously relied on the mailbox package's internal default) since the new check asserts against that literal.

Tests

• packages/inbox/test/routes.test.ts (new): HTTP-level regression test via Hono app.request — a db stub that throws if touched proves the rejection happens before any DB access. Verified by hand that this test fails (500, not 400) against pre-fix routes.ts.
• packages/inbox/test/cursor.test.ts (new): pure unit tests of cursorScopeMismatch (match, view/sort/filter mismatch, check ordering).
• Full @corbits/inbox suite: 29 pass / 3 skip / 0 fail.

Verification

• WORKBENCH_CHECK_SINCE=origin/main bun run typecheck — clean
• bun run check:structural — clean
• bun run lint — clean
• bunx prettier --check on touched files — clean
• Reviewed by Greybeard (approach) and Critique (implementation) before opening; both passes clean, no must-fix findings.

Known follow-ups (not blocking this PR)

• The view/sort/filter comparison now exists in two places (@corbits/mailbox's mount.ts and this new cursor.ts). Filed as a follow-up to upstream the check into @corbits/mailbox itself rather than duplicate it a third time if another caller needs it.
• Whether the consuming UI drops a stale cursor and refetches on the new 400 (vs. surfacing a raw error) wasn't investigated — this PR is backend-only per the ticket's scope.

Closes CL-7206.