fix: use SQL-level auth filtering for chat listing (#23159)

## Problem

The chat listing endpoint (`GetChatsByOwnerID`) was using
`fetchWithPostFilter`, which fetches N rows from the database and then
filters them in Go memory using RBAC checks. This causes a pagination
bug: if the user requests `limit=25` but some rows fail the auth check,
fewer than 25 rows are returned even though more authorized rows exist
in the database. The client may incorrectly assume it has reached the
end of the list.

## Solution

Switch to the same pattern used by `GetWorkspaces`, `GetTemplates`, and
`GetUsers`: `prepareSQLFilter` + `GetAuthorized*` variant. The RBAC
filter is compiled to a SQL WHERE clause and injected into the query
before `ORDER BY`/`LIMIT`, so the database returns exactly the requested
number of authorized rows.

Additionally, `GetChatsByOwnerID` is renamed to `GetChats` with
`OwnerID` as an optional (nullable) filter parameter, matching the
`GetWorkspaces` naming convention.

## Changes

| File | Change |
|------|--------|
| `queries/chats.sql` | Renamed to `GetChats`, `owner_id` now optional
via CASE/NULL, added `-- @authorize_filter` |
| `queries.sql.go` | Renamed constant, params struct (`GetChatsParams`),
and method |
| `querier.go` | Interface method renamed |
| `modelqueries.go` | Added `chatQuerier` interface +
`GetAuthorizedChats` impl |
| `dbauthz/dbauthz.go` | `GetChats` now uses `prepareSQLFilter` instead
of `fetchWithPostFilter` |
| `dbauthz/dbauthz_test.go` | Updated tests for SQL filter pattern |
| `dbmock/dbmock.go` | Renamed + added mock for `GetAuthorizedChats` |
| `dbmetrics/querymetrics.go` | Renamed + added metrics wrapper |
| `rbac/regosql/configs.go` | Added `ChatConverter` (maps `org_owner` to
empty string literal since `chats` has no `organization_id` column) |
| `rbac/authz.go` | Added `ConfigChats()` |
| `chats.go` | Handler uses renamed method with `uuid.NullUUID` |
| `searchquery/search.go` | Updated return type |
| `gitsync/worker.go` | Updated interface and call site |
| Various test files | Updated for renamed types |

coderd/rbac/authz.go

@@ -688,6 +688,15 @@ func ConfigWithoutACL() regosql.ConvertConfig {
 	}
 }
 
+// ConfigChats is the configuration for converting rego to SQL when
+// the target table is "chats", which has no organization_id or ACL
+// columns.
+func ConfigChats() regosql.ConvertConfig {
+	return regosql.ConvertConfig{
+		VariableConverter: regosql.ChatConverter(),
+	}
+}
+
 func ConfigWorkspaces() regosql.ConvertConfig {
 	return regosql.ConvertConfig{
 		VariableConverter: regosql.WorkspaceConverter(),

coderd/rbac/regosql/compile_test.go

@@ -282,6 +282,22 @@ neq(input.object.owner, "");
 				p("'10d03e62-7703-4df5-a358-4f76577d4e2f' = id :: text") + " AND " + p("id :: text != ''") + " AND " + p("'' = ''"),
 			),
 		},
+		{
+			Name: "ChatOwnerMe",
+			Queries: []string{
+				`"me" = input.object.owner; input.object.owner != ""; input.object.org_owner = ""`,
+			},
+			ExpectedSQL:       p(p("'me' = owner_id :: text") + " AND " + p("owner_id :: text != ''") + " AND " + p("'' = ''")),
+			VariableConverter: regosql.ChatConverter(),
+		},
+		{
+			Name: "ChatOrgScopedNeverMatches",
+			Queries: []string{
+				`input.object.org_owner = "org-id"`,
+			},
+			ExpectedSQL:       p("'' = 'org-id'"),
+			VariableConverter: regosql.ChatConverter(),
+		},
 	}
 
 	for _, tc := range testCases {

coderd/rbac/regosql/configs.go

@@ -126,6 +126,30 @@ func NoACLConverter() *sqltypes.VariableConverter {
 	return matcher
 }
 
+// ChatConverter should be used for the chats table, which has no
+// organization_id, group_acl, or user_acl columns.
+func ChatConverter() *sqltypes.VariableConverter {
+	matcher := sqltypes.NewVariableConverter().RegisterMatcher(
+		resourceIDMatcher(),
+		// The chats table has no organization_id column. Map org_owner
+		// to a literal empty string so that:
+		//  - User-level ownership checks (org_owner = '') activate correctly.
+		//  - Org-scoped permissions never match (org_owner will never equal
+		//    a real org UUID), which is intentional since chats are not
+		//    org-scoped resources.
+		// Note: custom org roles that include "chat" permissions will
+		// silently have no effect because of this mapping.
+		sqltypes.StringVarMatcher("''", []string{"input", "object", "org_owner"}),
+		userOwnerMatcher(),
+	)
+	matcher.RegisterMatcher(
+		sqltypes.AlwaysFalse(groupACLMatcher(matcher)),
+		sqltypes.AlwaysFalse(userACLMatcher(matcher)),
+	)
+
+	return matcher
+}
+
 func DefaultVariableConverter() *sqltypes.VariableConverter {
 	matcher := sqltypes.NewVariableConverter().RegisterMatcher(
 		resourceIDMatcher(),