feat: add boundary usage tracking database schema and tracker skeleton (#21670)

feat: add boundary usage telemetry database schema and RBAC

Adds the foundation for tracking boundary usage telemetry across Coder
replicas. This includes:

  - Database schema: `boundary_usage_stats` table with per-replica stats
    (unique workspaces, unique users, allowed/denied request counts)
  - Database queries: upsert stats, get aggregated summary, reset stats,
    delete by replica ID
  - RBAC: `boundary_usage` resource type with read/update/delete actions,
    accessible only via system `BoundaryUsageTracker` subject (not regular
    user roles)
  - Tracker skeleton + docs: stub implementation in `coderd/boundaryusage/`

The tracker accumulates stats in memory and periodically flushes to the
database. Stats are aggregated across replicas for telemetry reporting,
then reset when a new reporting period begins. The tracker implementation
and plumbing will be done in a subsequent commit/PR.

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

coderd/boundaryusage/tracker.go

@@ -0,0 +1,40 @@
+package boundaryusage
+
+import (
+	"context"
+	"sync"
+
+	"github.com/google/uuid"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/coderd/database"
+)
+
+// Tracker tracks boundary usage for telemetry reporting.
+//
+// All stats accumulate in memory throughout a telemetry period and are only
+// reset when a new period begins.
+type Tracker struct {
+	mu              sync.Mutex             //nolint:unused // Will be used when implemented.
+	workspaces      map[uuid.UUID]struct{} //nolint:unused // Will be used when implemented.
+	users           map[uuid.UUID]struct{} //nolint:unused // Will be used when implemented.
+	allowedRequests int64                  //nolint:unused // Will be used when implemented.
+	deniedRequests  int64                  //nolint:unused // Will be used when implemented.
+}
+
+// NewTracker creates a new boundary usage tracker.
+func NewTracker() (*Tracker, error) {
+	return nil, xerrors.New("not implemented")
+}
+
+// Track records boundary usage for a workspace.
+func (*Tracker) Track(_, _ uuid.UUID, _, _ int64) error {
+	return xerrors.New("not implemented")
+}
+
+// FlushToDB writes the accumulated stats to the database. All values are
+// replaced in the database (they represent the current in-memory state). If the
+// database row was deleted (new telemetry period), all in-memory stats are reset.
+func (*Tracker) FlushToDB(_ context.Context, _ database.Store, _ uuid.UUID) error {
+	return xerrors.New("not implemented")
+}