feat: bound AI-plan work to resource-control and stop zeroing missing tokens

Record the FIN-WP-0007 split after checking resource-control: they keep
intelligence resource identity and provision-level class I metering;
session tokens stay with State Hub; work-effectiveness is a reporting
join. Missing token counts are now unknown, not zero.

tests/test_models.py

@@ -40,6 +40,14 @@ def test_model_classes_importable():
     assert EngagementPrice.__tablename__ == "fin_engagement_prices"
 
 
+def test_token_spend_token_counts_are_nullable():
+    columns = TokenSpend.__table__.columns
+    assert columns["tokens_in"].nullable is True
+    assert columns["tokens_out"].nullable is True
+    assert columns["tokens_in"].default is None
+    assert columns["tokens_out"].default is None
+
+
 def test_service_cost_has_external_attribution_seam():
     columns = ServiceCost.__table__.columns
     assert columns["client_id"].nullable is True