Replaces the `GetUserByID` read used as an authz check in the AI budget-resolution queries with a targeted `authorizeContext` against the user resource. Same RBAC decision, one fewer db query per resolution step.
Follow-up to https://github.com/coder/coder/pull/27364#discussion_r3632577802.
> [!NOTE]
> Initially generated by Claude Opus 4.7, modified and reviewed by @ssncferreira