fix: Stop the paginator when a page cursor repeats

[razor-x]

What

Neither paginator had any loop guard: a server regression or proxy-cached page that repeats a next_page_cursor looped flatten() forever and grew flatten_to_list() until OOM — the per-request timeout resets every page, so nothing else stops the process (SDK audit finding M6; ports JS #1006 / PHP #466).

• Page traversal, previously duplicated across four loops (flatten / flatten_to_list × sync / async), is centralized in one private _walk() generator per paginator — the same single-walker shape as the JS fix, so the guard cannot be missing from one of the copies.
• _walk() keeps a seen-cursor set and stops silently when the server hands back a cursor it has already followed.

Stacked on #640; diff shrinks as the stack merges.

Testing

New tests (sync flatten_to_list, sync flatten, async) against a recording server that pins one cursor: the paginator fetches the first page, follows the cursor once, sees it repeat, and stops — request count pinned at exactly 2, per the JS-wave lesson that loop-guard tests must count requests, not just observe termination.

Revert check: with the previous paginator restored, the test loops until killed by a 15s timeout — the audit's infinite-loop symptom.

Full suite: 235 passed; mypy, pylint (10.00), black clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y1RzepycXEYA3LStfjt8cY

---

Generated by Claude Code