CLI and API client silently truncate target listings at 200 entries #3704

Describe the bug

The all-target listing fetches only the first API page and reports the partial count as the total, silently omitting remaining targets.

Steps/Code to Reproduce

On a fresh local backend create 205 TextTargets named qa_text_000 through qa_text_204 (the saved pagination repro creates the remaining 204 after the first). Run pyrit_scan list-targets against that backend.

Additional reproduction details

Start a backend with this credential-free config:

memory_db_type: in_memory
env_files: []
initializers: []
server:
  url: http://127.0.0.1:18741
  auth_mode: none

Start it with pyrit_backend --auth-mode none --host 127.0.0.1 --port 18741 --config-file local-config.yaml. Create qa_text_000 via POST /api/targets with {"name":"qa_text_000","type":"TextTarget","params":{}}; create names 001-204 similarly (the small saved probe uses httpx and get_compatibility_id() for the required compatibility header). GET /api/targets?limit=200 reports has_more=true, next_cursor=qa_text_199; cursor page has five more. SDK/CLI listing still reports 200 and misses qa_text_200 through qa_text_204. No credentials or external target required.

Expected Results

Fetch all pages for an all-target listing, or expose a limit/cursor and clearly identify the result as partial.

Actual Results

The first page contains 200 and reports has_more=true, next_cursor='qa_text_199'; the next page contains 5. list_targets_async returns 200 and the CLI prints Total targets: 200, omitting qa_text_200 through qa_text_204 without a truncation notice. Scenarios/initializers use the same one-page pattern but larger populations were not separately reproduced.

Verified source reference: API client listing methods.

Proposed fix/regression: follow cursor/has_more until exhaustion for targets, scenarios, and initializers; test with multiple pages and assert the reported total.

Screenshots

Not applicable; command output and page payloads are sufficient.

Versions

Tested commit d3446e0, PyRIT 1.2.0.dev0, offline local-backend scope. Recovery evidence: files/evidence/round1/pagination-repro.py, pagination.txt, list-targets-205.txt; these local paths are not attachments.