Message API returns 500 when tokens.total is null (NaN serialization)

Bug

getUsage() passes totalTokens raw without the safe() guard applied to all other token fields. When a provider returns NaN (e.g. from undefined + number), JSON.stringify(NaN) serializes as null. On read-back, null violates Schema.optional(Schema.Finite) causing a 500 MessageDecodeError on the message API.

Steps to Reproduce

1. Use a provider that occasionally returns undefined for usage fields (causing NaN via arithmetic)
2. The message gets stored with tokens.total: null in SQLite
3. Loading that session's messages returns 500

Expected Behavior

tokens.total should be sanitized like other token fields, and existing corrupted rows should be recovered gracefully on read.

Environment

• OS: macOS
• opencode: dev branch