API: GET /decisions malformed cursor silently resets to page 1 instead of 400

[gterdem]

Summary

adapters/decisions/sqlite_decisions.py _parse_cursor swallows a parse failure and silently falls back to page 1 on a malformed cursor query param, instead of returning a clean 4xx. Fails SAFE (no crash, no wrong data) but diverges from ADR-0029's cursor-envelope contract and the "malformed input → clean 4xx" expectation.

Acceptance criteria

• An unparseable cursor on GET /decisions SHALL yield a 400/422, not a silent page-1 reset.
• A test pins the malformed-cursor → 4xx behavior.

Origin: PR #107 (#47 backend) security review, non-blocking. Related: ADR-0029 D2.