fix(billing): extend quantity validation and saturating conversions to remaining paths

Bound max-tokens fields across all relay format validators, saturate
tiered-expression rounding and audio/tool/task token conversions, and
route legacy remix ratios through the guarded setter.

pkg/billingexpr/round.go

@@ -5,6 +5,20 @@ import "math"
 // QuotaRound converts a float64 quota value to int using half-away-from-zero
 // rounding. Every tiered billing path (pre-consume, settlement, breakdown
 // validation, log fields) MUST use this function to avoid +-1 discrepancies.
+//
+// The result saturates at int32 bounds: quota columns are 32-bit integers in
+// the database, and an oversized expression result must never wrap around
+// and turn a charge into a credit.
 func QuotaRound(f float64) int {
-	return int(math.Round(f))
+	r := math.Round(f)
+	if math.IsNaN(r) {
+		return 0
+	}
+	if r >= math.MaxInt32 {
+		return math.MaxInt32
+	}
+	if r <= math.MinInt32 {
+		return math.MinInt32
+	}
+	return int(r)
 }