Add mandatory pagination and 3-char search minimum to FacilityUsernameViewSet

[rtibblesbot]

Plan: Add mandatory pagination (default 10, max 20) and a 3-character minimum search requirement to FacilityUsernameViewSet, then update the sign-in page frontend to consume the new paginated response.

• Write failing backend tests
• Implement backend pagination and search validation
• Write failing frontend tests for SignInPage
• Implement frontend changes to consume paginated response

Summary

Add mandatory pagination to /api/auth/facilityusername/ — default page size 10, capped at 20 — and reject search params shorter than 3 characters with a 400. The sign-in page is updated to read usernames from data.results and determine listing-view eligibility from total_pages rather than num_users, so large facilities no longer transfer their full username list on facility selection.

References

Closes #14820

Reviewer guidance

1. With a facility that has Allow learners to sign in with no password enabled, sign out and select the facility on the sign-in page. For a facility with ≤16 passwordless learners, the clickable user list should appear; for a larger one, it should not — the listing-view decision now comes from the API's total_pages, not num_users.
2. On the username field, confirm the suggestions dropdown does not fire until 3 characters are typed.
3. Risky area: FacilityUsernameViewSet.list() in kolibri/core/auth/api.py — the 400 short-search path bypasses DRF's normal filter pipeline; verify that super().list() still runs filters correctly for ≥3-char searches.

AI usage

Claude Code (autonomous agent mode) implemented this via TDD: wrote failing backend tests, implemented the FacilityUsernamePagination class and list() override, then wrote failing frontend tests and updated SignInPage to consume the paginated response. I reviewed the plan before execution and the diff after.

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

• Ran pre-flight CI checks (lint, format, tests) and verified all pass
• Rebased onto the target branch and resolved any conflicts
• Reorganized commit history into clean, logical commits
• Audited the diff to ensure only issue-relevant files are changed
• Built PR body from the repository's PR template with evidence blocks

[github-actions]

Build Artifacts

Asset type	Download link
PEX file	kolibri-0.19.5.dev102_g6e13e5058.d20260606.pex
Windows Installer (EXE)	kolibri-0.19.5.dev102+g6e13e5058.d20260606-windows-setup-unsigned.exe
Debian Package	kolibri_0.19.5.dev102+g6e13e5058-0ubuntu1_all.deb
Mac Installer (DMG)	kolibri-0.19.5.dev102+g6e13e5058.d20260606.dmg
Android Package (APK)	kolibri-0.19.5.dev102+g6e13e5058.d20260606-0.1.10-debug.apk
Raspberry Pi Image	kolibri-pi-image-0.19.5.dev102+g6e13e5058.zip
TAR file	kolibri-0.19.5.dev102+g6e13e5058.d20260606.tar.gz
WHL file	kolibri-0.19.5.dev102+g6e13e5058.d20260606-py3-none-any.whl

Smoke test screenshot

Download screenshot