feat: report user secrets adoption summary in telemetry (#24854)

Add a deployment-wide user secrets summary to the telemetry snapshot so
we can track adoption of user secrets
The summary reports:

- A breakdown of secrets by which injection fields are populated:
EnvNameOnly, FilePathOnly, Both, Neither
- The distribution of secrets per user (max, p25, p50, p75, p90)

All metrics are scoped to active non-system users. Soft-deleted users
are excluded. The percentile distribution is computed across the entire
active non-system user base, including users with zero secrets, so the
percentiles reflect deployment-wide adoption.

Assisted by Coder Agents.

coderd/database/migrations/000486_user_secrets_telemetry_lock.down.sql

@@ -0,0 +1,8 @@
+-- Restore the previous telemetry_locks event_type constraint. Existing
+-- user_secrets_summary rows must be removed first or the new constraint
+-- check would fail.
+DELETE FROM telemetry_locks WHERE event_type = 'user_secrets_summary';
+
+ALTER TABLE telemetry_locks DROP CONSTRAINT telemetry_lock_event_type_constraint;
+ALTER TABLE telemetry_locks ADD CONSTRAINT telemetry_lock_event_type_constraint
+    CHECK (event_type IN ('aibridge_interceptions_summary', 'boundary_usage_summary'));

coderd/database/migrations/000486_user_secrets_telemetry_lock.up.sql

@@ -0,0 +1,7 @@
+-- Add user_secrets_summary to the telemetry_locks event_type constraint.
+-- User secrets aggregates do not have a natural per-row UUID for the
+-- telemetry server to dedupe on, so we elect a single replica per
+-- snapshot period to report them via this lock table.
+ALTER TABLE telemetry_locks DROP CONSTRAINT telemetry_lock_event_type_constraint;
+ALTER TABLE telemetry_locks ADD CONSTRAINT telemetry_lock_event_type_constraint
+    CHECK (event_type IN ('aibridge_interceptions_summary', 'boundary_usage_summary', 'user_secrets_summary'));

coderd/database/migrations/testdata/fixtures/000486_user_secrets_telemetry_lock.up.sql

@@ -0,0 +1,3 @@
+-- Smoke fixture: a single user_secrets_summary lock for a fixed period.
+INSERT INTO telemetry_locks (event_type, period_ending_at)
+VALUES ('user_secrets_summary', '2026-01-01 00:00:00+00');