Backport of #27419

Original PR: #27419 — fix: remove 403 from key failover and cooldown on
401
Merge commit: dba45ce
Requested by: @ssncferreira

Backport of #27544

Original PR: #27544 — fix(coderd): reject workspace proxy hostname
prefixes
Merge commit: 8cc7f2b
Requested by: @geokat

Co-authored-by: George K <george@coder.com>
Co-authored-by: Bobby Ho <bobbidinho@gmail.com>

…/2.35 (#27850)

Backport of #27481 to `release/2.35`.

## Problem
`canViewAnyOrganization` included `viewAnyMembers`, a permission every
user now has because of workspace sharing. This meant the Admin settings
dropdown (and the Organizations entry within it) showed up for every
user, not just admins.

## Fix
- Removed `permissions.viewAnyMembers` from `canViewAnyOrganization` in
`site/src/modules/permissions/index.ts`.
- Updated `site/e2e/tests/roles.spec.ts` to match, including a new
regression test for org members with no roles.

## Note on scope
Upstream #27481 also refactored `DeploymentDropdown`/`MobileMenu` into a
shared `AdminSettings.tsx` component driven by a single permissions
object. That refactor doesn't apply to `release/2.35`: this branch's
`DeploymentDropdown` and `MobileMenu` already gate the Admin settings
menu with equivalent per-permission checks, so only the actual
permission fix and its test coverage are backported here.

## Validation
- `pnpm exec biome check` on the two changed files: clean.
- Confirmed pre-existing `tsc` errors in this branch are unrelated
environment/dependency issues (reproduced identically on a clean
`release/2.35` checkout).

> 🤖 This PR was created with the help of Coder Agents, and needs a human
review. 🧑💻

---------

Co-authored-by: Jeremy Ruppel <jeremy.ruppel@gmail.com>

## What

Updates `google.golang.org/grpc` from `v1.81.1` → `v1.82.1` on
`release/2.35`.

## Why

IronBank's scan of Coder **v2.35.3** flagged `google.golang.org/grpc
v1.81.1` as vulnerable to **GHSA-hrxh-6v49-42gf** (GO-2026-6061). The
relevant exposure is the HTTP/2 Rapid Reset-style DoS; the xDS RBAC
auth-bypass half of the advisory is not used by Coder. Fixed in
**v1.82.1**.

`main` (v1.83.0) and `v2.36.0` (v1.82.1) already carry the fix — this is
the backport to `release/2.35`. The matching `release/2.34` backport is
tracked separately (ENT-144).

## Change

- `go.mod`: `google.golang.org/grpc v1.81.1` → `v1.82.1`
- `go.sum`: grpc hash lines only

No transitive fan-out — `release/2.35` already had the `x/net` /
`protobuf` / `x/sys` / `x/text` versions grpc 1.82.1 requires.

## Validation (local; `golangci-lint` at the CI-pinned v1.64.8)

- `go build ./...` — clean
- `go vet ./tailnet/... ./codersdk/...` — clean
- `golangci-lint run` (full repo) — 0 issues
- `go run ./scripts/intxcheck ./...` — clean
- `go mod tidy` stable; `go mod verify` OK

DB-backed test suites (`make test-postgres`) will run in CI.

Linear: ENT-143

## What

Updates `github.com/DataDog/dd-trace-go/v2` from `v2.0.0` → `v2.8.1`
(indirect) on `release/2.35`.

## Why

`github.com/DataDog/dd-trace-go/v2 v2.0.0` is vulnerable to
**CVE-2026-50274**. It is an indirect dependency pulled in by the direct
`gopkg.in/DataDog/dd-trace-go.v1 v1.74.0` shim that `coderd/tracing`
uses. Flagged by the IronBank scan of Coder v2.35.3. Fixed in **v2.8.1**
(matches `v2.36.0`/`main`).

Companion to the `release/2.34` backport (ENT-141).

## Change

`go get github.com/DataDog/dd-trace-go/v2@v2.8.1 && go mod tidy`. This
reproduces the DataDog dependency cluster exactly as shipped on
`v2.36.0` — every module added/changed matches `v2.36.0`'s `go.mod`
(verified, zero mismatches). Notable transitive effects:

- **`go-libddwaf/v3` → `/v4`** (major-version module swap; v3 removed)
- `datadog-agent/pkg/*` 0.64.2 → 0.77.0 (plus new
`pkg/trace/{log,otel,stats,traceutil}`, `pkg/template`,
`pkg/opentelemetry-mapping-go/otlp/attributes`)
- `datadog-go/v5` 5.6.0→5.8.3, and bumps to `go-sqllexer`,
`sketches-go`, `go-tuf`, `go-runtime-metrics-internal`
-
`go.opentelemetry.io/collector/{component,pdata,pdata/pprofile,featuregate}`
1.27 → 1.51; dropped `collector/semconv`, `appsec-internal-go`,
`Masterminds/semver/v3`, `eapache/queue/v2`, `gogo/protobuf`

`go.mod` +34/−31 require lines, `go.sum` +110/−98. All new/changed
entries are `// indirect`.

## Validation (local; `golangci-lint` at the CI-pinned v1.64.8)

- `go build ./...` — clean
- `go vet ./coderd/tracing/... ./codersdk/...` — clean
- `go test ./coderd/tracing/...` — ok
- `golangci-lint run` (full repo) — 0 issues
- `go run ./scripts/intxcheck ./...` — clean
- `go mod tidy` stable; `go mod verify` OK

DB-backed suites (`make test-postgres`) run in CI.

Linear: ENT-142

Co-authored-by: Marcin Tojek <mtojek@users.noreply.github.com>