feat(gateway): make List pagination token-only, drop web cursor secret

Makefile

@@ -46,7 +46,6 @@ export REPO_ROOT := $(shell pwd)
 # Local-only credential for the reference web host. Override it for manual
 # testing; production authentication is deliberately outside this demo.
 export SUBMITQUEUE_WEB_TOKEN ?= test
-export SUBMITQUEUE_WEB_CURSOR_SECRET ?= local-demo-cursor-secret
 
 # Which provider the demo stack targets, and the only difference between a free
 # local run and a live one. Selects a configuration directory rather than a code

api/submitqueue/gateway/proto/gateway.proto

@@ -139,13 +139,17 @@ message GetRequestSummaryByChangeURIResponse {
 message ListRequest {
     // Exact queue to query.
     string queue = 1;
-    // Inclusive lower receipt-time bound in Unix milliseconds.
-    int64 received_at_or_after_ms = 2;
-    // Exclusive upper receipt-time bound in Unix milliseconds.
-    int64 received_before_ms = 3;
+    oneof received_lower_bound {
+        // Inclusive receipt-time bound in Unix milliseconds. Required without page_token; with page_token, omitted takes the token's bound and supplied must equal it.
+        int64 received_at_or_after_ms = 2;
+    }
+    oneof received_upper_bound {
+        // Exclusive receipt-time bound in Unix milliseconds. Required without page_token; with page_token, omitted takes the token's bound and supplied must equal it.
+        int64 received_before_ms = 3;
+    }
     // Maximum results to return. Zero selects the server default; values above the server maximum are invalid.
     int32 page_size = 4;
-    // Opaque continuation token from a previous response. Empty selects the first page.
+    // Opaque continuation token from a previous response, bound to its queue and receipt window. Empty selects the first page.
     string page_token = 5;
 }
 
@@ -155,6 +159,10 @@ message ListResponse {
     repeated RequestSummary requests = 1;
     // Opaque continuation token. Empty when this is the last page.
     string next_page_token = 2;
+    // Inclusive lower receipt-time bound of the window this page was read from, in Unix milliseconds.
+    int64 received_at_or_after_ms = 3;
+    // Exclusive upper receipt-time bound of the window this page was read from, in Unix milliseconds.
+    int64 received_before_ms = 4;
 }
 
 // Queue identifies a configured submit queue.