fix: hide AI budget override controls without permission - #27654

Description

Setting a user's AI budget override updates both the user and the group its spend is charged to, so it requires user:update and group:update. Organization admins have group update but only site-wide user read, so they could tick "Override group budget", enter an amount, and then fail on save.

The dialog now shows the member's budget as read-only when the viewer can't change it.

Changes

• Gate the override controls on user:update (site-wide) in addition to the group permission the page already checks
• Replace the form with a read-only view: the group's budget, followed by "To update this limit, contact a Coder administrator."
• Swap the whole view rather than disabling the checkbox, since an existing override seeds the form enabled and unchecking it would call the delete endpoint and fail the same way
• Add stories for the read-only dialog and for the page-level wiring