Server: a cursor carries the sync horizon it was issued under, so a read from the beginning after a collection is not refused on its own pages

A cursor behind the horizon was refused on position alone. But the read a
refused client starts from the beginning is itself behind the horizon on
every page until it passes the collected deletion, since older untouched
items come first. So its second page was refused, it started over, and it
never finished, on any vault larger than one page.

The cursor now records the horizon read before the page that produced it,
and only a cursor issued under an older horizon is refused. A cursor issued
under no horizon keeps the v1 format, so a server from before this still
reads it.

tests/DodoSSH.Domain.Tests/Sync/SyncCursorTests.cs

@@ -152,6 +152,36 @@ public sealed class SyncCursorTests
         Should.Throw<ArgumentOutOfRangeException>(() => SyncCursor.Encode(Key, VaultId, -1));
     }
 
+    [Fact]
+    public void CarriesTheHorizonItWasIssuedUnder()
+    {
+        var cursor = SyncCursor.Encode(Key, VaultId, 12, horizon: 40);
+
+        SyncCursor.TryDecode(Key, cursor, VaultId, out var sequence, out var horizon).ShouldBeTrue();
+        sequence.ShouldBe(12);
+        horizon.ShouldBe(40);
+    }
+
+    [Fact]
+    public void UnderNoHorizon_KeepsTheFirstFormat()
+    {
+        // So a server from before horizons, still running beside a newer one mid-deploy, reads what the newer
+        // one issues for every vault nothing has been collected from.
+        SyncCursor.Encode(Key, VaultId, 12, horizon: 0).ShouldBe(SyncCursor.Encode(Key, VaultId, 12));
+
+        SyncCursor.TryDecode(Key, SyncCursor.Encode(Key, VaultId, 12), VaultId, out _, out var horizon)
+            .ShouldBeTrue();
+        horizon.ShouldBe(0);
+    }
+
+    [Fact]
+    public void ACursorWithAHorizon_IsStillBoundToItsVault()
+    {
+        var cursor = SyncCursor.Encode(Key, OtherVaultId, 12, horizon: 40);
+
+        SyncCursor.TryDecode(Key, cursor, VaultId, out _, out _).ShouldBeFalse();
+    }
+
     [Fact]
     public void DifferentSequencesProduceDifferentCursors()
     {