feat: add GET /api/v2/agent-firewall/sessions/{id}/logs endpoint (#24816)

Add a `GET /api/v2/agent-firewall/sessions/{id}/logs` endpoint that
returns agent firewall audit logs for a given session, sorted by
sequence number ascending.

The endpoint supports `seq_after` and `seq_before` (exclusive bounds)
and `limit` query parameters. This enables the frontend to fetch exactly
the firewall events that fall between two AI Bridge interceptions within
a thread, as described in FR 4 of the Boundary/Bridge correlation RFC.

Authorization reuses the `boundary_log` RBAC resource (owner and auditor
can read; members cannot). Returns 404 for unauthorized users to avoid
leaking existence information.

The endpoint is enterprise-only, gated behind `FeatureBoundary`
entitlement, matching the session endpoint from #24814.

Depends on #24814

> [!NOTE]
> This PR was authored by Coder Agents.

coderd/database/queries/boundarylogs.sql

@@ -64,14 +64,14 @@ SELECT * FROM boundary_logs WHERE id = @id;
 
 -- name: ListBoundaryLogsBySessionID :many
 -- Lists boundary logs for a session, sorted by sequence number ascending.
--- Supports optional exclusive sequence number bounds (seq_after, seq_before)
--- for fetching events between two known interceptions.
+-- Supports an inclusive lower bound (seq_after) and an exclusive upper bound
+-- (seq_before) for fetching events between two known interceptions.
 SELECT *
 FROM boundary_logs
 WHERE
     session_id = @session_id
     AND CASE
-        WHEN sqlc.narg('seq_after')::int IS NOT NULL THEN sequence_number > sqlc.narg('seq_after')
+        WHEN sqlc.narg('seq_after')::int IS NOT NULL THEN sequence_number >= sqlc.narg('seq_after')
         ELSE true
     END
     AND CASE