Fix user.list Rejecting Null Cursor and SyncToken

user.list now correctly accepts null for the cursor and syncToken request fields again. Sending {"cursor": null} to fetch the first page was returning invalid_input after the recent Zod validation migration; this has been fixed. Omitting the fields or passing a valid string value continues to work as before.