feat(coderd): resolve effective user AI budget (#26142)

Closes
https://linear.app/codercom/issue/AIGOV-287/add-effective-group-resolution

Implements the effective AI budget resolution from the AI Governance
cost-controls RFC: for a given user, a `user_ai_budget_overrides` row
wins if present, otherwise the deployment budget policy (`highest`)
picks the largest group budget across the user's groups, ties broken
alphabetically.

For now, I keep the logic under `coderd/aibridge/budget`, but that may
change during the implementation of budget enforcement.

coderd/database/queries/aicostcontrol.sql

@@ -57,3 +57,25 @@ RETURNING *;
 
 -- name: DeleteUserAIBudgetOverride :one
 DELETE FROM user_ai_budget_overrides WHERE user_id = @user_id RETURNING *;
+
+-- name: GetHighestGroupAIBudgetByUser :one
+-- Returns the highest group AI budget across the groups the user belongs to,
+-- breaking ties by group name ascending. Implements the "highest" budget policy.
+-- group_members_expanded is a UNION of group_members and organization_members,
+-- so the implicit "Everyone" group (group_id == organization_id) is included.
+-- Returns no rows when the user has no budgeted groups; callers should treat
+-- sql.ErrNoRows as "no group budget".
+SELECT
+	gaib.group_id,
+	gaib.spend_limit_micros
+FROM group_ai_budgets gaib
+JOIN group_members_expanded gme ON gme.group_id = gaib.group_id
+WHERE gme.user_id = @user_id
+ORDER BY
+	gaib.spend_limit_micros DESC, -- highest wins
+	gme.group_name ASC,           -- alphabetical tiebreak
+	-- Final tiebreak on the group id makes the result deterministic when two
+	-- groups share both name and limit, which is possible across organizations
+	-- (groups are unique on (organization_id, name), not name alone).
+	gaib.group_id ASC
+LIMIT 1;