Fixes several independent user-facing issues:

• Lets user admins reset another user's password by using system-restricted DB access only for API key invalidation after the handler authorizes the password update.
• Returns effective user roles from /users/{user}/roles, including implied site and organization roles, and filters implied roles out of the interactive role editor defaults.
• Adds --ephemeral-parameter and --prompt-ephemeral-parameters to coder create, with generated CLI docs and golden help updates.
• Prevents invalid external app URLs from crashing the frontend during app link rendering.
• Allows me in Swagger UI for enterprise quiet-hours endpoints by documenting the path parameter as a string instead of UUID-only.

Closes #25873
Closes #26002
Closes #25832
Closes #22349
Closes #24473