fix(auth): prevent token refresh loop on 401 response

feat(api): add pagination to /users endpoint

Previously the endpoint returned all users in a single response,
which caused timeouts for accounts with > 10k users.

Adds cursor-based pagination with a default page size of 50.
Existing clients are unaffected - the endpoint returns all results
when no cursor param is provided.

Closes #892

refactor(config): rename DATABASE_URL to DB_CONNECTION_STRING

BREAKING CHANGE: The DATABASE_URL environment variable is no longer
read. Rename it to DB_CONNECTION_STRING in all deployment configs.

## What

One paragraph: what this PR does and why.

## How

Brief explanation of the approach taken. Link to relevant docs or
prior art if the approach is non-obvious.

## Testing

How you verified it works. "Tested manually" is acceptable for small
changes; describe the steps.

## Screenshots (if UI change)

Before / after where helpful.

## Checklist
- [ ] Tests added or updated
- [ ] Docs updated (if public API changed)
- [ ] No unrelated changes included

### Added
- New feature description (#PR or commit hash)

### Changed
- What changed and how it affects users

### Fixed
- Bug description (what it was, what it is now)

### Removed
- What was removed and migration path if needed

### Breaking
- Description + migration instructions