feat: add coderd_ai_user_budget_override resource

[ssncferreira]

Description

Adds the coderd_ai_user_budget_override resource, which manages an AI spend limit for a single user and the group their spend is attributed to (/api/v2/users/{user}/ai/budget/override). Stacked on #453.

Changes

• Add coderd_ai_user_budget_override with user_id, group_id, and spend_limit, registered under the "AI Governance" docs subcategory.
• Reuse the spend_limit validators and conventions from coderd_ai_group_budget, and link the two resources in the docs.
• Import by user ID or username, like coderd_user.
• Add an example, import docs, mock-server plan tests, and an acceptance test.

Closes AIGOV-682

Note

Generated by Coder Agents on behalf of @ssncferreira.

[linear-code]

AIGOV-682

[ethanndickson]

Could we update integration/agents-model-test to cover this resource and coderd_ai_group_budget, like #445 and #448 did for the other AI resources? Something like:

• create a user, add it to the existing agents-users group, and give the group a coderd_ai_group_budget and the user a coderd_ai_user_budget_override, all in the same apply
• assert that UserAISpendStatus for that user returns the override's limit with limit_source set to user_override

The acceptance tests for both resources create the users and groups through the SDK, so nothing applies this example shape end to end or checks that Coder enforces the override over the group budget.

Generated by an agent on behalf of the user

[ethanndickson]

A 404 here doesn't only mean a missing group or an old Coder. Coder also returns 404 when the user_id doesn't exist, or when the token can't update the user or the group: UpsertUserAIBudgetOverride checks update on both, and the handler maps the denial to 404 through httpapi.Is404Error.

An Organization Admin or Organization User Admin token hits this. Those roles can read users site-wide but can't update them, so the plan-time conflict check passes, then the apply fails with "Group Not Found or Unsupported Coder Version" while the group exists and Coder is new enough. #453 documents those roles as enough for coderd_ai_group_budget, so the same token can apply the group budget and then hit this.

Could the comment and the message cover the missing user and missing permission cases too, similar to the 404 message in agentsSystemPromptDiag?

Generated by an agent on behalf of the user