feat(source-api): follow the paged product list

[alukach]

source-cooperative/source.coop#590 (#651) pages GET /api/v1/products/{account}: it answers {"items": [...], "next_cursor": ...} where it answered {"products": [...]}, which was also silently cut off at 50. Today SourceProductList requires products, so once that deploys every S3 ListObjects at an account root (s3://{account}/) would fail to parse and answer 500 — while CI stayed green, because the stub serves the old shape.

The account-root listing now asks for ?limit=100 and follows next_cursor until there is none, collecting every product ID. items also accepts products as an alias, and the current API ignores the query and sends no cursor, so this reads one unpaged list from it exactly as before: this can merge and deploy before or after source.coop, which is the point.

Each page is its own URL, so each is cached for PRODUCT_LIST_CACHE_SECS on its own; an account with more than 100 products costs one API call per 100 on a cold listing, where today it silently lists only the first 50. ADR-007's lookup table still holds (same URL, same anonymous caller, same 60s per response), so it isn't amended.

Tests: tests/stub_api.py serves the new shape; fixtures.rs pins the paged, last-page and old unpaged shapes; the nightly test_contract.py asks for ?limit=100 and reads items, falling back to products until source.coop deploys, after which the fallback can go. cargo test, cargo fmt --check and cargo clippy --target wasm32-unknown-unknown -- -D warnings pass locally.

🤖 Generated with Claude Code

[claude]

Claude finished @alukach's task in 10s —— View job

---

I'll analyze this and get back to you.

---

💰 Estimated review cost: $0.10 · 0m09s · 4 turns

[github-actions]

🚀 Latest commit deployed to https://source-data-proxy-pr-253.source-coop.workers.dev

• Date: 2026-10-09T06:47:58Z
• Commit: 5fafdc6