feat: add network calls column to AI sessions table (#27269)

Add a "Total/blocked network calls" column to the AIBridge sessions
table.

Update `ListAIBridgeSessions` query to calculate network called made and
blocked per session. See query plan
[here](https://explain.dalibo.com/plan/54355c90b165ggb4).

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

codersdk/aibridge.go

@@ -125,8 +125,13 @@ type AIBridgeSession struct {
 	EndedAt           *time.Time                       `json:"ended_at,omitempty" format:"date-time"`
 	Threads           int64                            `json:"threads"`
 	TokenUsageSummary AIBridgeSessionTokenUsageSummary `json:"token_usage_summary"`
-	LastPrompt        *string                          `json:"last_prompt,omitempty"`
-	LastActiveAt      time.Time                        `json:"last_active_at" format:"date-time"`
+	// NetworkCalls summarizes the Agent Firewall network calls made during the
+	// session. A nil value means the session did not pass through Agent
+	// Firewall, so network call monitoring was not active, which the UI
+	// surfaces as "Disabled".
+	NetworkCalls *AIBridgeSessionNetworkCallSummary `json:"network_calls,omitempty"`
+	LastPrompt   *string                            `json:"last_prompt,omitempty"`
+	LastActiveAt time.Time                          `json:"last_active_at" format:"date-time"`
 }
 
 type AIBridgeSessionTokenUsageSummary struct {
@@ -136,6 +141,14 @@ type AIBridgeSessionTokenUsageSummary struct {
 	CacheWriteInputTokens int64 `json:"cache_write_input_tokens"`
 }
 
+// AIBridgeSessionNetworkCallSummary aggregates the Agent Firewall network
+// calls made during a session. Blocked counts calls denied by the firewall
+// allow-list.
+type AIBridgeSessionNetworkCallSummary struct {
+	Total   int64 `json:"total"`
+	Blocked int64 `json:"blocked"`
+}
+
 type AIBridgeListSessionsResponse struct {
 	Count    int64             `json:"count"`
 	Sessions []AIBridgeSession `json:"sessions"`