feat: display the AI add-on column in the UI on the Users and Organization Members tables (#23291)

## Summary

Adds an entitlement-gated **AI add-on** column to both the **Users**
table and the **Organization Members** table. When
`ai_governance_user_limit` is entitled, each row shows whether the user
is consuming an AI seat.

## Background

The AI governance add-on tracks which users are consuming AI seats.
Admins need visibility into per-user seat consumption directly from the
user management tables. This change surfaces that information through
both the site-wide Users table and the per-organization Members table,
gated behind the `ai_governance_user_limit` entitlement so the column
only appears when the feature is licensed.

## Implementation

### Backend
- **New SQL query** `GetUserAISeatStates`
(`coderd/database/queries/aiseatstate.sql`) — returns user IDs consuming
an AI seat, derived from:
  - Users with entries in `aibridge_interceptions` (AI Bridge usage)
- Users who own workspaces with `has_ai_task = true` builds (AI Tasks
usage)
- **SDK types** — added `has_ai_seat: boolean` to `codersdk.User` and
`codersdk.OrganizationMemberWithUserData`
- **Handler wiring** — both the Users list endpoint (`coderd/users.go`)
and all Members endpoints (`coderd/members.go`) query AI seat state per
page of user IDs and populate the response field
- **dbauthz** — per-user `ActionRead` checks on `ResourceUserObject`

### Frontend
- **Shared `AISeatCell` component**
(`site/src/modules/users/AISeatCell.tsx`) — green `CircleCheck` for
consuming, gray `X` for non-consuming
- **`TableColumnHelpTooltip`** — extended with `ai_addon` variant with
tooltip: *"Users with access to AI features like AI Bridge, Boundary, or
Tasks who are actively consuming a seat."*
- **Column visibility** gated behind
`useFeatureVisibility().ai_governance_user_limit`

## Validation

- Backend: dbauthz full method suite (`TestMethodTestSuite`) passes
including new `GetUserAISeatStates` test
- Backend: `TestGetUsers`, `TestUsersFilter`, CLI golden file tests pass
- Frontend: 7/7 tests pass across `UsersPage.test.tsx` and
`OrganizationMembersPage.test.tsx` (column visibility gating both
directions)
- `go build ./coderd/...` compiles clean
- `pnpm --dir site run lint:types` passes
- `make gen` clean

## Risks

- **Pagination performance**: The AI seat query is scoped to the current
page's user IDs (not a full table scan), keeping it efficient for
paginated views.
- **Semantic scope**: The workspace-side AI seat derivation uses "any
build with `has_ai_task = true`" rather than "latest build only". If the
product intent is latest-build-only, this can be tightened in a
follow-up.

---

_Generated with `mux` • Model: `anthropic:claude-opus-4-6` • Thinking:
`xhigh` • Cost: `$27.25`_

<!-- mux-attribution: model=anthropic:claude-opus-4-6 thinking=xhigh
costs=27.25 -->

codersdk/organizations.go

@@ -73,17 +73,20 @@ type OrganizationMember struct {
 }
 
 type OrganizationMemberWithUserData struct {
-	Username           string     `table:"username,default_sort" json:"username"`
-	Name               string     `table:"name" json:"name,omitempty"`
-	AvatarURL          string     `json:"avatar_url,omitempty"`
-	Email              string     `json:"email"`
-	Status             UserStatus `json:"status" enums:"active,suspended"`
-	LoginType          LoginType  `json:"login_type"`
-	LastSeenAt         time.Time  `table:"last seen at" json:"last_seen_at,omitempty" format:"date-time"`
-	UserCreatedAt      time.Time  `table:"user created at" json:"user_created_at" format:"date-time"`
-	UserUpdatedAt      time.Time  `table:"user updated at" json:"user_updated_at" format:"date-time"`
-	IsServiceAccount   bool       `json:"is_service_account,omitempty"`
-	GlobalRoles        []SlimRole `json:"global_roles"`
+	Username         string     `table:"username,default_sort" json:"username"`
+	Name             string     `table:"name" json:"name,omitempty"`
+	AvatarURL        string     `json:"avatar_url,omitempty"`
+	Email            string     `json:"email"`
+	Status           UserStatus `json:"status" enums:"active,suspended"`
+	LoginType        LoginType  `json:"login_type"`
+	LastSeenAt       time.Time  `table:"last seen at" json:"last_seen_at,omitempty" format:"date-time"`
+	UserCreatedAt    time.Time  `table:"user created at" json:"user_created_at" format:"date-time"`
+	UserUpdatedAt    time.Time  `table:"user updated at" json:"user_updated_at" format:"date-time"`
+	IsServiceAccount bool       `json:"is_service_account,omitempty"`
+	GlobalRoles      []SlimRole `json:"global_roles"`
+	// HasAISeat intentionally omits omitempty so the API always includes the
+	// field, even when false.
+	HasAISeat          bool `json:"has_ai_seat"`
 	OrganizationMember `table:"m,recursive_inline"`
 }
 

codersdk/users.go

@@ -98,6 +98,9 @@ type User struct {
 
 	OrganizationIDs []uuid.UUID `json:"organization_ids" format:"uuid"`
 	Roles           []SlimRole  `json:"roles"`
+	// HasAISeat intentionally omits omitempty so the API always includes the
+	// field, even when false.
+	HasAISeat bool `json:"has_ai_seat"`
 }
 
 type GetUsersResponse struct {