fix: harden cursor pagination against null values and stale keys

Three small follow-ups based on review feedback on the audit PR's twin
implementation:

- Drop the always-true `!empty($orderAttributes)` guard inside the cursor
  branch. resolveCursorOrder() always appends an `id` tiebreaker, so the
  guard is dead code and was misleading.
- normalizeCursorRow now removes `$id` after copying it to `id`, so cursor
  state is no longer carrying both keys.
- Throw an explicit Exception when a cursor value is null. The previous
  path silently routed null `time` cursors through formatDateTime(null)
  which returns the current timestamp — a misconfigured cursor would
  filter on `time < now()` and produce wrong pages instead of failing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: lohanidamodar

src/Usage/Adapter/ClickHouse.php

@@ -1523,7 +1523,9 @@ private function findFromTable(array $queries, string $type): array
         $params = $whereData['params'];
 
         $orderClause = '';
-        if (isset($parsed['cursor']) && !empty($orderAttributes)) {
+        if (isset($parsed['cursor'])) {
+            // $orderAttributes is always non-empty here — resolveCursorOrder
+            // appends an `id` tiebreaker when no order is specified.
             $orderSql = $this->buildOrderBySql($orderAttributes, flip: $cursorDirection === 'before');
             $orderClause = ' ORDER BY ' . implode(', ', $orderSql);
         } elseif (!empty($parsed['orderBy'])) {
@@ -2446,6 +2448,7 @@ private function normalizeCursorRow(mixed $rawCursor): array
 
         if (!array_key_exists('id', $row) && array_key_exists('$id', $row)) {
             $row['id'] = $row['$id'];
+            unset($row['$id']);
         }
 
         return $row;
@@ -2524,36 +2527,42 @@ private function buildCursorWhere(array $orderAttributes, array $cursor, string
                     throw new \Exception("Cursor is missing required attribute '{$prevAttr}'");
                 }
                 $prevValue = $cursor[$prevAttr];
+                if ($prevValue === null) {
+                    throw new \Exception("Cursor value for '{$prevAttr}' cannot be null");
+                }
                 $prevEscaped = $this->escapeIdentifier($prevAttr);
                 $prevType = $this->getParamType($prevAttr);
                 $paramName = "cursor_eq_{$i}_{$j}";
 
                 if ($prevAttr === 'time') {
-                    /** @var \DateTime|string|null $timeValue */
+                    /** @var \DateTime|string $timeValue */
                     $timeValue = $prevValue;
                     $conditions[] = "{$prevEscaped} = {{$paramName}:DateTime64(3)}";
                     $params[$paramName] = $this->formatDateTime($timeValue);
                 } else {
-                    /** @var bool|float|int|string|null $scalarValue */
+                    /** @var bool|float|int|string $scalarValue */
                     $scalarValue = $prevValue;
                     $conditions[] = "{$prevEscaped} = {{$paramName}:{$prevType}}";
                     $params[$paramName] = $this->formatParamValue($scalarValue);
                 }
             }
 
             $value = $cursor[$attr];
+            if ($value === null) {
+                throw new \Exception("Cursor value for '{$attr}' cannot be null");
+            }
             $escaped = $this->escapeIdentifier($attr);
             $chType = $this->getParamType($attr);
             $operator = $direction === 'DESC' ? '<' : '>';
             $paramName = "cursor_cmp_{$i}";
 
             if ($attr === 'time') {
-                /** @var \DateTime|string|null $timeValue */
+                /** @var \DateTime|string $timeValue */
                 $timeValue = $value;
                 $conditions[] = "{$escaped} {$operator} {{$paramName}:DateTime64(3)}";
                 $params[$paramName] = $this->formatDateTime($timeValue);
             } else {
-                /** @var bool|float|int|string|null $scalarValue */
+                /** @var bool|float|int|string $scalarValue */
                 $scalarValue = $value;
                 $conditions[] = "{$escaped} {$operator} {{$paramName}:{$chType}}";
                 $params[$paramName] = $this->formatParamValue($scalarValue);