Add limit/offset/order query params to table_view

[amyleesterling]

Problem

/annotation/views/aligned_volume/<av>/table/<t> is hardcoded to render the first 15 rows of every annotation table in default insertion order and exposes no URL params for sorting or paging:

query = db.database.cached_session.query(Model).limit(15)

This makes the view unusable for two common workflows:

• Verifying a freshly-written annotation. New rows get the largest id, but the view only ever shows ids 1–15, so users can't see what they just inserted without dropping to the API.
• Browsing a table past row 15. A 480-row cell-type table is effectively a 15-row preview in the UI.

Fix

Accept three optional query params on table_view:

Param	Type	Default	Notes
limit	int	15	Clamped to [1, 500] to cap I/O
offset	int	0	Clamped to [0, ∞)
order	str	asc	asc or desc on Model.id

Defaults preserve current behavior exactly: a parameterless URL still returns the first 15 rows in ascending id order. The template gains a "Showing rows N–M of TOTAL" line plus prev / next / toggle-order links.

Verification

After deploy, on a table with N rows (e.g. ~480):

• ?limit=20&offset=460&order=asc — last 20 rows of the table.
• ?limit=10&order=desc — newest 10 rows (most recent writes first).
• no params — original first 15 rows in ascending order (unchanged).

A bad value (e.g. ?limit=abc, ?offset=-5, ?order=sideways) falls back to the corresponding default rather than 500ing.

Risk

Minimal. Default URL is byte-identical to current behavior. The only new I/O path is .offset(N).limit(M) against the same indexed id column the table is already sorted on, capped at 500 rows per request. auth_requires_permission decorator is untouched, so authn/authz semantics are unchanged. fix_wkb_columns(df) still runs on the post-paged result.

Independent of the materializer pyarrow (pa.default_serialization_context) bug and the recently-merged CORS change on the Flask app — neither is touched here.