feat: implement boundary usage tracker and telemetry collection (#21716)

Implements telemetry for boundary usage tracking across all Coder
replicas and reports them via telemetry.

Changes:
- Implement Tracker with Track(), FlushToDB(), and StartFlushLoop() methods
- Add telemetry integration via collectBoundaryUsageSummary()
- Use telemetry lock to ensure only one replica collects per period

The tracker accumulates unique workspaces, unique users, and request
counts (allowed/denied) in memory, then flushes to the database
periodically. During telemetry collection, stats are aggregated across
all replicas and reset for the next period.

coderd/agentapi/boundary_logs.go

@@ -8,16 +8,21 @@ import (
 
 	"cdr.dev/slog/v3"
 	agentproto "github.com/coder/coder/v2/agent/proto"
+	"github.com/coder/coder/v2/coderd/boundaryusage"
 )
 
 type BoundaryLogsAPI struct {
-	Log               slog.Logger
-	WorkspaceID       uuid.UUID
-	TemplateID        uuid.UUID
-	TemplateVersionID uuid.UUID
+	Log                  slog.Logger
+	WorkspaceID          uuid.UUID
+	OwnerID              uuid.UUID
+	TemplateID           uuid.UUID
+	TemplateVersionID    uuid.UUID
+	BoundaryUsageTracker *boundaryusage.Tracker
 }
 
 func (a *BoundaryLogsAPI) ReportBoundaryLogs(ctx context.Context, req *agentproto.ReportBoundaryLogsRequest) (*agentproto.ReportBoundaryLogsResponse, error) {
+	var allowed, denied int64
+
 	for _, l := range req.Logs {
 		var logTime time.Time
 		if l.Time != nil {
@@ -32,6 +37,12 @@ func (a *BoundaryLogsAPI) ReportBoundaryLogs(ctx context.Context, req *agentprot
 				continue
 			}
 
+			if l.Allowed {
+				allowed++
+			} else {
+				denied++
+			}
+
 			fields := []slog.Field{
 				slog.F("decision", allowBoolToString(l.Allowed)),
 				slog.F("workspace_id", a.WorkspaceID.String()),
@@ -52,6 +63,10 @@ func (a *BoundaryLogsAPI) ReportBoundaryLogs(ctx context.Context, req *agentprot
 		}
 	}
 
+	if a.BoundaryUsageTracker != nil && (allowed > 0 || denied > 0) {
+		a.BoundaryUsageTracker.Track(a.WorkspaceID, a.OwnerID, allowed, denied)
+	}
+
 	return &agentproto.ReportBoundaryLogsResponse{}, nil
 }