Add 'until' to API routes that list things

[f-f]

The fact that having only the since parameter in the API routes was not very ergonomic already came up in previous discussions with @thomashoneyman, but trying to put together a dashboard for the logs (as per #742) cemented this idea.

Here we add an until parameter, so that the default when neither since nor until are provided is that we fetch the last items until now, which I think is a sensible default.

Bonus: we add a CORS middleware as well here, also needed for the dashboard.

[f-f]

@thomashoneyman good catch with that review – I have reworked the design so it's cleaner:

• the range is now [since,until) as per the comments
• I realised that it made no sense to leave since/until unspecified since we know the lower bound for since (the registry launch) and the upper bound for until (now, as we can't have logs/jobs in the future), so I made them only optional at the API boundary, but they are always known at the database layer. This makes for simpler queries
• the missing piece was the "ordering" parameter, clients need to be able to pass that in. So now we default to ASC (for backwards compatibility), but clients can pass DESC as well