feat: add boundary usage tracking database schema and tracker skeleton (#21670)

feat: add boundary usage telemetry database schema and RBAC

Adds the foundation for tracking boundary usage telemetry across Coder
replicas. This includes:

  - Database schema: `boundary_usage_stats` table with per-replica stats
    (unique workspaces, unique users, allowed/denied request counts)
  - Database queries: upsert stats, get aggregated summary, reset stats,
    delete by replica ID
  - RBAC: `boundary_usage` resource type with read/update/delete actions,
    accessible only via system `BoundaryUsageTracker` subject (not regular
    user roles)
  - Tracker skeleton + docs: stub implementation in `coderd/boundaryusage/`

The tracker accumulates stats in memory and periodically flushes to the
database. Stats are aggregated across replicas for telemetry reporting,
then reset when a new reporting period begins. The tracker implementation
and plumbing will be done in a subsequent commit/PR.

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

coderd/database/queries/boundaryusagestats.sql

@@ -0,0 +1,48 @@
+-- name: UpsertBoundaryUsageStats :one
+-- Upserts boundary usage statistics for a replica. All values are replaced with
+-- the current in-memory state. Returns true if this was an insert (new period),
+-- false if update.
+INSERT INTO boundary_usage_stats (
+    replica_id,
+    unique_workspaces_count,
+    unique_users_count,
+    allowed_requests,
+    denied_requests,
+    window_start,
+    updated_at
+) VALUES (
+    @replica_id,
+    @unique_workspaces_count,
+    @unique_users_count,
+    @allowed_requests,
+    @denied_requests,
+    NOW(),
+    NOW()
+) ON CONFLICT (replica_id) DO UPDATE SET
+    unique_workspaces_count = EXCLUDED.unique_workspaces_count,
+    unique_users_count = EXCLUDED.unique_users_count,
+    allowed_requests = EXCLUDED.allowed_requests,
+    denied_requests = EXCLUDED.denied_requests,
+    updated_at = NOW()
+RETURNING (xmax = 0) AS new_period;
+
+-- name: GetBoundaryUsageSummary :one
+-- Aggregates boundary usage statistics across all replicas. Filters to only
+-- include data where window_start is within the given interval to exclude
+-- stale data.
+SELECT
+    COALESCE(SUM(unique_workspaces_count), 0)::bigint AS unique_workspaces,
+    COALESCE(SUM(unique_users_count), 0)::bigint AS unique_users,
+    COALESCE(SUM(allowed_requests), 0)::bigint AS allowed_requests,
+    COALESCE(SUM(denied_requests), 0)::bigint AS denied_requests
+FROM boundary_usage_stats
+WHERE window_start >= NOW() - (@max_staleness_ms::bigint || ' ms')::interval;
+
+-- name: ResetBoundaryUsageStats :exec
+-- Deletes all boundary usage statistics. Called after telemetry reports the
+-- aggregated stats. Each replica will insert a fresh row on its next flush.
+DELETE FROM boundary_usage_stats;
+
+-- name: DeleteBoundaryUsageStatsByReplicaID :exec
+-- Deletes boundary usage statistics for a specific replica.
+DELETE FROM boundary_usage_stats WHERE replica_id = @replica_id;