Limit filtered ListEvents responses

[rootp1]

Summary

• Limit label-filtered ListEvents responses to the requested logical page size.
• Return a cursor based on the last event actually included when filtering reaches PageSize inside a datastore page.

Linked Issue

Fixes #7085

What Changed

• Added a helper for appending label-matched events up to PageSize.
• Added regression coverage for dense matches, sparse matches, and zero-match filtering.

Verification

• go test ./pkg/app/server/grpcapi — passed
• go test -race ./pkg/app/server/grpcapi — passed
• docker run --rm -e GOCACHE=/repo/.cache/go-build -e GOLANGCI_LINT_CACHE=/repo/.cache/golangci-lint -v ${PWD}:/repo -w /repo golangci/golangci-lint:latest golangci-lint run -v --config /repo/.golangci.yml --fix=false ./pkg/app/server/grpcapi — passed
• make check — failed: repository-pinned make lint/go image uses golangci-lint built with Go 1.25, while this repo targets Go 1.26.2
• make test/go MODULES=. — failed: pkg/oci could not dial /var/run/docker.sock in this environment
• DOCKER_HOST=unix:///Users/rootp1/.colima/default/docker.sock go test -race ./pkg/oci — passed
• DOCKER_HOST=unix:///Users/rootp1/.colima/default/docker.sock make test/go MODULES=. — failed: pkg/oci local registry tests returned EOF in the full suite; rerunning pkg/oci alone passed
• make test/web — passed
• make lint/web — passed
• make lint/helm — passed
• make check/gen/code — no-op because the Makefile target is named check/gen
• make check/gen — failed: target uses docker run -it, which cannot attach stdin in this non-interactive environment
• docker run --rm -v ${PWD}:/repo --entrypoint ./tool/codegen/codegen.sh ghcr.io/pipe-cd/codegen@sha256:8b17498a7cfb58fbaf403ec7cab01a740238aaee43d030e65a40abb710f9e68a /repo && git diff --exit-code --quiet HEAD -- <generated paths> — passed
• make check/dco — failed: script compares against stale origin/master and flagged upstream commit 25ae69937e55e8330bff96c34346718f3e5e7148; upstream/master..HEAD contains only this signed-off commit

Scope

• Only pkg/app/server/grpcapi/web_api.go and pkg/app/server/grpcapi/web_api_test.go were changed.

What this PR does:

Caps filtered ListEvents responses at PageSize and returns a continuation cursor from the last returned event when filtering fills a page.

Why we need it:

Without this, ListEvents can append every matching event from the final scanned datastore page and return more events than requested.

Which issue(s) this PR fixes:

Fixes #7085

Does this PR introduce a user-facing change?:

NONE