Message pagination accepts malformed cursor characters

Description

The message pagination endpoint accepts malformed Base64URL cursors. Appending an invalid character such as ! to a valid cursor still decodes to the original cursor and returns HTTP 200. Malformed cursors should return 400 InvalidCursorError, as session pagination already does.

Plugins

None

OpenCode version

Current dev at dff8fbc149

Steps to reproduce

1. Request /api/session/:id/message?limit=1 and save cursor.next.
2. Request the next page with cursor=<saved cursor>!.
3. Observe HTTP 200 and the same page as the unmodified cursor.

Expected: HTTP 400 with InvalidCursorError.

Screenshot and/or share link

Not applicable

Operating System

Linux x86_64

Terminal

OpenCode CLI