feat: add per-license Products section with Coder Agents price gates - #28051

…ents

The usage generator writes hb_agent_runtime_v1 rows with created_at at
the UTC hourly bucket start and exactly one row per bucket, but nothing
in the schema enforced either invariant. A duplicate bucket row under a
different id would be double-counted by any consumer summing runtime_ms,
and a misaligned created_at would skew which usage period a bucket is
attributed to.

Replace the non-unique partial index idx_usage_events_agent_runtime with
a unique index of the same shape and add an hour-alignment CHECK
constraint. generateBucket treats a unique violation on the bucket index
as another replica having won the race, mirroring the existing
ON CONFLICT (id) no-op for committed rows.

…able runtime hours claims

Two coupled changes to the license/entitlements layer.

Measurement diagnostics: extract a measureUsage helper that owns the
usage-query failure policy. A query failure now publishes the stable
codersdk.LicenseManagedAgentUsageUnavailableErrorText on the
entitlements Errors channel (keeping the alertable coderd_license_errors
gauge counting) while the raw cause goes to the coderd log through the
new FeatureArguments.Logger. A nil usage closure becomes a hard
developer error, and a failure with a dead context still aborts the
whole refresh. The managed agent count closure switches from
AsSystemRestricted to the narrower AsUsagePublisher subject. The
dashboard recognizes diagnostic texts and renders them muted, without
the exceedance heading or a sales link.

Claim tolerance: unusable agent_runtime_hours_* claim combinations no
longer reject the whole license. decodeAgentRuntimeHours drops the
unusable claims, reports them in a stable
LicenseAgentRuntimeHoursClaimsIgnoredWarningText warning (deduplicated
across licenses), and logs the affected license and claims;
validateAgentRuntimeHours and its license-invalidating errors are
removed. Rejecting a signed license over a cosmetic threshold claim
would drop the deployment to unlicensed.

Part of the stack for #27796.

Populate FeatureAgentRuntimeHours.Actual on every entitlements refresh
for licenses that grant the feature. A new
GetTotalUsageHBAgentRuntimeV1 query sums runtime_ms over the license's
usage period, reading usage_events directly: hb_agent_runtime_v1 is
exactly one row per hourly bucket deployment-wide, enforced by the
unique partial index idx_usage_events_agent_runtime.

The measurement reuses the shared measureUsage policy through a new
AgentRuntimeMsFn closure (usage publisher subject): failures publish
the stable LicenseAgentRuntimeUsageUnavailableErrorText and log the
cause. Usage is floored to whole hours, matching the unit of the
agent_runtime_hours_* claims, and at most one warning is emitted:
reaching the allocation supersedes the advisory soft limit. The
dashboard renders the soft-limit advisory muted without a sales link
and treats the runtime usage-unavailable text as a diagnostic.

Closes CODAGT-852.

…mplate goldens with generators"

This reverts commit ed531d9d365720b4e394f4b422ea9776886c56a3.

The gen/fmt drift it patched over came from main commit 07f79af
(fix: markdown rendering improvements) having landed out of sync with
its generators; main has since reverted that commit entirely in
8c2f7ad (#27979), so the sync is obsolete and conflicts with the
regenerated goldens on latest main.

…ments

…ments

…s unlimited

An agent_runtime_hours_allocation claim of exactly -1 now grants the
agent_runtime_hours feature enabled with a nil Limit, which the
entitlements API serves as an omitted "limit" field, the shape the UI
already renders as Unlimited. Threshold claims alongside it are dropped
with the existing claims-ignored warning, and any other negative
allocation remains unusable.

…ments-work

An unlimited (-1) allocation decodes to an enabled agent_runtime_hours
feature with a nil Limit, so the warning write-back now guards the
allocation dereference: no thresholds can exist for an unlimited
license, so no runtime hours warning is ever emitted. Actual usage is
still measured and published. Feature.Compare is unchanged; the
metered-beats-unlimited-on-exact-tie edge is pinned by a test and
documented on decodeAgentRuntimeHours.

The expanded arbiter-scoping commentary is not needed on the insert
query; the duplicate-bucket behavior is documented on the migration and
in generateBucket where it is handled.

…ments

Resolves LicenseBannerView.stories.tsx by adopting the base branch's
convention: data-variant assertions are dropped (visual snapshots cover
mutedness), so the runtime hour stories keep only their text and
sales-link assertions.

…000567

Main landed its own 000565 and 000566 (oauth2 client type constraint and
auth method backfill) after this branch was cut, making the migration
number a duplicate that fails migrate setup.

…ments

Adopts the base branch's trimmed comment style for the shared license
warning constants and diagnostics tests, keeping the runtime-hours
constants and the soft-limit prefix-coupling note; typesGenerated.ts is
regenerated.

…e comment

…ating story assertions

A nil Limit on a usage period feature means unlimited, so Feature.Compare now ranks it above any set limit when issued-at and end dates tie. Also types the LicenseBanner map callbacks as LicenseBannerMessage instead of using as const assertions.

… per-license Products section with Coder Agents price gates

Each license card now always expands to a Products section: a Coder
Workspaces box with active seat usage, and (on Premium licenses) a Coder
Agents box driven by the agent_runtime_hours_* license claims and merged
agent_runtime_hours entitlement.

The Coder Agents box renders five states: no allocation (dashed purple
upgrade CTA), unlimited (-1 sentinel), normal usage, allocation exceeded
(red border, red 'Agent hours exceeded' status, chats stay Unlimited),
and hard limit exceeded (red 'Hard limit exceeded' status, chats capped
at 5, mirroring the backend's maxConcurrentRootAgents). Usage and
overage indicators follow the AI Governance winning-license pattern via
a generalized isLicenseApplicableForFeatureUsage helper.

The header gains a Type column (Trial/Standard) and the left label now
shows the feature set only (Premium/Enterprise).

…ir story queries broken by design updates

…rt product card states semantically in stories