routes: query and list endpoints for attestations and usage

[joelpeace48-cell]

Problem

There is no read API. Once attestations are being written there is no way to
retrieve them, so the dashboard, the exports, and any integrator verification
flow all have nothing to call.

What to do

• GET /v1/attestations with filters: payer, model, policy, date range, status.
• GET /v1/attestations/:id returning the record plus its verification
  material — transaction hash, ledger sequence, contract address.
• GET /v1/usage with the same filter vocabulary plus aggregation
  (group_by=model|payer|day).
• Cursor pagination, not offset — offset pagination over a continuously
  growing table skips and repeats rows as new data arrives.
• Authorization scoped to the caller: a payer sees only their own records.
• Cap page size and total result windows.

Acceptance criteria

• List and detail endpoints with consistent filter vocabulary
• Cursor pagination with a documented, stable sort
• Row-level authorization enforced and tested
• Page size and window caps

Notes

Row-level authorization is the one to test hardest. A filter parameter that can
be widened to another tenant's data is the classic multi-tenant leak.

[ayo-ola0710]

hello maintainer , i would like to take these up pls

[joelpeace48-cell]

HI @ayo-ola0710 , you're assigned, ensure all ci pipelines are green

[grantfox-oss]

🦊 GrantFox — @ayo-ola0710 has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #56)
2. Your PR will be reviewed by the FinesseStudioLab maintainers

Good luck! Track your progress on GrantFox.