feat: add bulk user secret import endpoint and SDK client (PLAT-240) (#26724)

Adds `POST /api/v2/users/{user}/secrets/batch` and
`codersdk.Client.ImportUserSecrets` to import env, JSON, or YAML secrets
atomically. The endpoint validates each entry, rolls back the full batch
on conflicts or limits, omits secret values from responses and audit
logs, and imports keys that cannot be injected as environment variables
with an empty `env_name`.

Part of the [PLAT-240 bulk secret import
stack](https://linear.app/codercom/issue/PLAT-240). Reviewed and updated
by Coder Agents on behalf of @dylanhuff-at-coder.

codersdk/usersecretsimport.go

@@ -33,7 +33,9 @@ type secretEntry struct {
 
 // ParseSecretsFile parses a secrets file into CreateUserSecretRequests.
 // It checks structure and duplicate keys; per-entry validation is left to
-// ValidateCreateUserSecretRequest.
+// ValidateCreateUserSecretRequest. EnvName is set only when the key passes
+// env-name validation (best-effort; keys like MY-TOKEN or PATH get an empty
+// EnvName so they are still imported without env injection).
 func ParseSecretsFile(format SecretsFileFormat, content string) ([]CreateUserSecretRequest, error) {
 	if len(content) > MaxSecretsFileBytes {
 		return nil, xerrors.Errorf("secrets file exceeds the maximum allowed size of %d bytes", MaxSecretsFileBytes)
@@ -80,15 +82,19 @@ func ParseSecretsFile(format SecretsFileFormat, content string) ([]CreateUserSec
 
 	reqs := make([]CreateUserSecretRequest, 0, len(entries))
 	for _, e := range entries {
-		reqs = append(reqs, CreateUserSecretRequest{
-			Name:    e.key,
-			EnvName: e.key,
-			Value:   e.value,
-		})
+		req := CreateUserSecretRequest{Name: e.key, Value: e.value}
+		// env_name uses a partial unique index (WHERE env_name != ''),
+		// so multiple empty env_names are allowed.
+		if UserSecretEnvNameValid(e.key) == nil {
+			req.EnvName = e.key
+		}
+		reqs = append(reqs, req)
 	}
 	return reqs, nil
 }
 
+// Duplicate keys are rejected up front (citing the line for env files)
+// instead of surfacing as a per-row uniqueness violation later.
 func detectDuplicateKeys(entries []secretEntry) error {
 	seen := make(map[string]struct{}, len(entries))
 	for _, e := range entries {