Backport of #28340

Original PR: #28340 — fix: prevent markdown injection in notifications
Merge commit: 9e8075d
Requested by: @BobbyHo

Co-authored-by: Bobby Ho <[email protected]>

) (#28604)

Backport of #28397

Original PR: #28397 — fix(coderd/notifications): HTML-escape the email
template values
Merge commit: 2236710
Requested by: @BobbyHo

## Why the automatic cherry-pick failed

The bot ran before #28609 (the backport of #28340) had landed on
`release/2.36`. #28397 amends a comment directly above the `escaped :=
payload.EscapedForMarkdown()` block that #28340 introduced, so with that
block absent the hunk had no context to anchor to. #28609 is on
`release/2.36` now, so that part applies cleanly.

## Manual resolution: 5 golden files dropped

Re-picking on the current base leaves a genuine `modify/delete` conflict
on five golden files:

```
TemplateUserAccountActivatedServiceAccount.html.golden
TemplateUserAccountCreatedServiceAccount.html.golden
TemplateUserAccountCreatedWithoutAccountType.html.golden
TemplateUserAccountDeletedServiceAccount.html.golden
TemplateUserAccountSuspendedServiceAccount.html.golden
```

These are fixtures for the service-account notification templates, which
postdate the 2.36 branch point — `coderd/notifications/` on
`release/2.36` contains no reference to `ServiceAccount` or
`AccountType`, so there is no template to render them and no test case
that reads them. **All five were removed rather than added**; carrying
them over would leave orphan fixtures.

This is the only deviation from the original PR. Verified with a
diff-of-diffs: excluding those five paths, this commit is byte-identical
to #28397. The escaping changes to `html.gotmpl`, `notifier.go` and
`smtp_internal_test.go` are fully intact.

Net: 34 files, +234/−79 (upstream: 39 files, +244/−89 — the delta is
exactly the five goldens). The smtp golden directory holds 43 files
before and after, so nothing was added or lost.

## Verification

- `go vet ./coderd/notifications/dispatch/` — clean
- `go test ./coderd/notifications/dispatch/...` — pass, including the
three new `TestSMTPHTMLTemplateEscapes*` tests
- `go test ./coderd/notifications/ -run
TestNotificationTemplates_Golden` — pass across all 31 affected goldens

Co-authored-by: Bobby Ho <[email protected]>

…8648)

Backport of #28513

Original PR: #28513 — fix(coderd): reject agent requests from suspended
owners
Merge commit: 2f50b2d
Requested by: @hwang251

Co-authored-by: Hank Hwang <[email protected]>
Co-authored-by: Marcin Tojek <[email protected]>

Backport of #28494

Original PR: #28494 — fix: enable Copilot HTTP transport fallback
Merge commit: 849543d
Requested by: @ssncferreira

Co-authored-by: Susana Ferreira <[email protected]>

Cherry-picks:
* ad10045 fixes token accumulation
logic for chat completions PR #27967
* 3ca2ba4 adds cache write tokens
accounting to OpenAI interceptors, PR
#28567

Compatibility fix:
* ae737db bumps OpenAI SDK + minimal
changes, bump required by cherry picks, based on
c97f4da3ac

---------

Co-authored-by: Michael Suchacz <[email protected]>

Cherry-pick of [#28802](#28802)
(`e2a856d42b`), matching
[#28810](#28810) for `release/2.37`.

Deletes cached Terraform module archives ingested during the identified
window and clears the template version references to them. Runs from
`dbpurge` rather than a migration, because migrations cannot be
backported: the version table records a single high-water mark, so a
migration cherry-picked here would cause later upgrades to skip every
migration in between.

## Conflict resolution

The commit did not apply cleanly. This branch predates the chat search
work on `main`, so the incoming hunks carried unrelated context that was
dropped:

- `dbpurge.go`: took only the module cache block, the
`ranModuleCachePurge` latch, the window constants, the
`identified_module_files` log field and metric, and the
`identifiedModuleCachePurged` instance field. This branch has the
`chat_messages.search_tsv` backfill but not the stale reindex added in
#28585, so the reindex loop, `staleDrained`, and
`chatSearchStaleDrained` were dropped.
- `dbpurge_test.go`: took `TestDeleteIdentifiedModuleCacheFiles`. In the
two `TestMetrics` mock setups, added only the
`DeleteCachedModuleFilesCreatedBetween` expectation, dropping
`ReindexStaleChatMessagesSearchTsv`.
- Generated files (`querier.go`, `queries.sql.go`, `dbmetrics`,
`dbmock`, and the `dbauthz` stub) were reset to the branch state and
regenerated from `queries/files.sql`, rather than taking the diff from
`main`. Taking `main`'s versions would have introduced methods for
queries that do not exist on this branch.

## Testing

`coderd/database/dbpurge` and `TestMethodTestSuite` in
`coderd/database/dbauthz` pass against Postgres. `make gen` is clean.

Pre-commit hooks were skipped on the final commit at the author's
request after the checks above had already been run; `make gen`, build,
and lint were verified separately during conflict resolution.

---

Opened by Coder Agents on behalf of @Emyrk.