hotfix(acks): paginate /api/acks and surface server-side aggregates

The Acks page silently capped at 100 of 1056 rows in the operator's
DB: the eyebrow read `${items.length} on file` (not the server's
`total`), the KPI strip summed from the 100 visible items, and the
endpoint accepted no `offset` — so the user had no signal that 956
more acks existed. Same class of bug on the Activity page (cap=200,
no 'X of Y' hint).

Backend
- /api/acks (acks.py): add `offset`, bump `le=1000`→`le=5000`,
  slice `rows[offset:offset+limit]`, return server-side
  `aggregates` (accepted/rejected/received summed over the full
  row set, not the page) so the KPI strip reflects every persisted
  999 instead of just the visible 50.
- /api/activity list + stream (api.py): bump `le=500`→`le=5000` so
  the page can ask for a denser snapshot.
- /api/277ca-acks (api.py): bump `le=1000`→`le=5000` for
  consistency.
- /api/ta1-acks: left at `le=1000` — TA1s aren't shipped today and
  the structural fix (offset + aggregates) wasn't applied, so a
  larger cap would just make the same latent silent-failure easier
  to hit. (TODO: fold in the same shape when Gainwell starts
  shipping TA1s.)

Frontend
- listAcks (api.ts): accept `offset`, surface `aggregates`,
  adapt wire `*_count` keys to the in-page
  `accepted`/`rejected`/`received` shape so the page can use
  `data.aggregates` as a drop-in for the page-local fallback
  accumulator.
- useAcks (hooks): pass `offset` through; return type carries
  `aggregates`.
- Acks.tsx: add `page` state (PAGE_SIZE=50), use `data.total`
  for eyebrow + watermark (not `items.length`), use
  `data.aggregates` for the KPI strip (with in-page fallback
  accumulator on first paint), render `<Pagination>` when
  `totalCount > PAGE_SIZE`. Footer row reads "N rows on file"
  instead of "N rows".
- ActivityLog.tsx: bump `limit: 200`→`limit: 500`, eyebrow reads
  "Activity · showing N most recent" to make the bounded-window
  semantics honest (the endpoint doesn't expose a true total — it
  reports events matching the current kind/since filter, capped at
  the request limit).

Tests
- test_acks.py: 4 new tests pin the fix:
  1. `offset` walks the full set; `has_more` flips at the
     boundary.
  2. `aggregates` reflects the full row set, not the page (the
     silent-failure pin) — and stays stable across page slices.
  3. `limit` cap of 5000 is enforced (422 above it).
  4. `offset` past the end returns an empty page with stable
     aggregates (a stale UI page state across a row count change
     must not 500 or zero the KPIs).

Live smoke-verified: /api/acks?limit=2&offset=0 vs ?offset=2 return
the expected row slices, aggregates stable at 15/10/15 for 5 seeded
rows, /api/acks?limit=10000 rejected with 422.

Triage note: the TA1 section (`Ta1AcksSection`, lines 609-616 of
Acks.tsx) has the same latent silent-failure pattern (page-sums
KPIs, no offset on /api/ta1-acks). Left untouched because the
empty-state copy says Gainwell doesn't ship TA1s today and the
larger structural fix belongs in a follow-up.

backend/tests/test_acks.py

@@ -128,3 +128,154 @@ def test_get_ack_returns_row_when_present():
     assert fetched.id == row.id
     assert fetched.source_batch_id == "b-1"
     assert fetched.raw_json == {"hello": "world"}
+
+
+# ---------------------------------------------------------------------------
+# Hotfix 2026-06-29: acks list endpoint silently capped at limit=100
+# without exposing the true total or full-set aggregates, so the Acks page
+# rendered "100 on file" and KPI totals summed from the page only when the
+# row count exceeded 100. These tests pin the new offset param + the
+# server-side `aggregates` field so the silent-failure mode can't regress.
+# ---------------------------------------------------------------------------
+
+
+def _seed_acks(n: int) -> list[int]:
+    """Insert n ack rows with deterministic per-row counts. Returns the ids."""
+    _make_batch("b-hotfix")
+    ids: list[int] = []
+    for i in range(n):
+        row = store.add_ack(
+            source_batch_id="b-hotfix",
+            accepted_count=i + 1,
+            rejected_count=i,
+            received_count=i + 1,
+            ack_code="A",
+            raw_json={"order": i},
+        )
+        ids.append(row.id)
+    return ids
+
+
+def test_list_acks_endpoint_pagination_offsets_correctly():
+    """`offset` walks the full set, `has_more` flips at the boundary."""
+    from fastapi.testclient import TestClient
+    from cyclone.api import app
+    from cyclone.auth.users import create
+    from cyclone.db import SessionLocal
+
+    with SessionLocal()() as s:
+        create(s, username="u", password="p", role="admin")
+        s.commit()
+    client = TestClient(app)
+    client.post("/api/auth/login", json={"username": "u", "password": "p"})
+
+    _seed_acks(5)
+
+    r = client.get("/api/acks?limit=2&offset=0")
+    d = r.json()
+    assert d["total"] == 5
+    assert d["returned"] == 2
+    assert d["has_more"] is True
+    assert len(d["items"]) == 2
+
+    r = client.get("/api/acks?limit=2&offset=4")
+    d = r.json()
+    assert d["total"] == 5
+    assert d["returned"] == 1
+    assert d["has_more"] is False
+    assert len(d["items"]) == 1
+
+
+def test_list_acks_endpoint_aggregates_reflect_full_set():
+    """`aggregates` sums over the full row set, not the page.
+
+    Without this the Acks KPI strip silently under-reports once the
+    row count exceeds the page size — the silent-failure the operator
+    flagged on 2026-06-29.
+    """
+    from fastapi.testclient import TestClient
+    from cyclone.api import app
+    from cyclone.auth.users import create
+    from cyclone.db import SessionLocal
+
+    with SessionLocal()() as s:
+        create(s, username="u", password="p", role="admin")
+        s.commit()
+    client = TestClient(app)
+    client.post("/api/auth/login", json={"username": "u", "password": "p"})
+
+    # 5 rows: accepted = 1+2+3+4+5 = 15, rejected = 0+1+2+3+4 = 10,
+    # received = same as accepted.
+    _seed_acks(5)
+
+    # Page 1 of 2 — full set is 5 rows, page only shows 2, but aggregates
+    # must reflect all 5.
+    r = client.get("/api/acks?limit=2&offset=0")
+    d = r.json()
+    assert d["total"] == 5
+    assert d["returned"] == 2
+    assert d["aggregates"]["accepted_count"] == 15
+    assert d["aggregates"]["rejected_count"] == 10
+    assert d["aggregates"]["received_count"] == 15
+
+    # Page 2 must return identical aggregates — page slice mustn't shift them.
+    r = client.get("/api/acks?limit=2&offset=2")
+    d = r.json()
+    assert d["aggregates"]["accepted_count"] == 15
+    assert d["aggregates"]["rejected_count"] == 10
+    assert d["aggregates"]["received_count"] == 15
+
+
+def test_list_acks_endpoint_limit_cap_is_5000():
+    """The validator still enforces an upper bound so a client can't
+    request 1,000,000 rows and OOM the SQLite-backed list call."""
+    from fastapi.testclient import TestClient
+    from cyclone.api import app
+    from cyclone.auth.users import create
+    from cyclone.db import SessionLocal
+
+    with SessionLocal()() as s:
+        create(s, username="u", password="p", role="admin")
+        s.commit()
+    client = TestClient(app)
+    client.post("/api/auth/login", json={"username": "u", "password": "p"})
+
+    r = client.get("/api/acks?limit=10000")
+    assert r.status_code == 422  # FastAPI validation error
+
+    r = client.get("/api/acks?limit=5000")
+    assert r.status_code == 200
+
+
+def test_list_acks_endpoint_offset_past_end_returns_empty_page():
+    """`offset` past the row count must yield an empty page, not 500.
+
+    Pinning this so a future refactor that introduces streaming or
+    cursor-based pagination can't accidentally error or 500 when the
+    UI holds stale page state across a row count change.
+    """
+    from fastapi.testclient import TestClient
+    from cyclone.api import app
+    from cyclone.auth.users import create
+    from cyclone.db import SessionLocal
+
+    with SessionLocal()() as s:
+        create(s, username="u", password="p", role="admin")
+        s.commit()
+    client = TestClient(app)
+    client.post("/api/auth/login", json={"username": "u", "password": "p"})
+
+    _seed_acks(3)
+
+    r = client.get("/api/acks?limit=2&offset=99")
+    assert r.status_code == 200
+    d = r.json()
+    assert d["total"] == 3
+    assert d["returned"] == 0
+    assert d["has_more"] is False
+    assert d["items"] == []
+    # Aggregates must still reflect the full 3-row set on the empty page —
+    # otherwise a stale UI page state would silently zero out the KPI strip.
+    assert d["aggregates"]["accepted_count"] == 1 + 2 + 3
+    assert d["aggregates"]["rejected_count"] == 0 + 1 + 2
+    assert d["aggregates"]["received_count"] == 1 + 2 + 3