List endpoints return 500 on PostgreSQL when the cursor is not a valid id #8889

Current Behavior

Same bug as #8879, in the other paginated lists. An invalid cursor decodes to an empty array, Sequelize renders the cursor clause as id < '' or id > '', and PostgreSQL rejects it with invalid input syntax for type integer: "". SQLite returns an empty page.

Affected finders and routes:

• Notification.forUser: GET /api/v1/user/notifications
• User.getAll: GET /api/v1/users
• ProjectType.getAll: GET /api/v1/project-types
• ProjectTemplate.getAll: GET /api/v1/templates
• DeviceGroup.getAll: team and application device group lists
• BrokerCredentials.byTeam: team broker client list

Expected Behavior

An invalid cursor returns 400 invalid_cursor on every list, as the audit log does since #8879.

Steps To Reproduce

1. Run the platform against PostgreSQL.
2. GET /api/v1/user/notifications?cursor=abc.
3. The response is a 500 with invalid input syntax for type integer: "".

Suggested Fix

Move decodeCursor from the AuditLog model to the shared model setup next to decodeHashid, and use it in each of these finders.