feat: remove agents-access role and enable Coder Agents by default - #28184

Removes the org-scoped agents-access ("Coder Agents User") role and enables Coder Agents for every organization member by default.

Closes https://linear.app/codercom/issue/CODAGT-554/remove-agents-access-role-and-enable-agents-by-default

Why

Coder Agents access previously required granting the agents-access role user by user, per organization. There was no org-wide or default enablement, which made rollout painful. Per-user enablement is unusually unergonomic for basic product functionality, so Agents is now on by default for regular members.

What changed

• RBAC: the chat permissions the role carried (create, read, share, update on owned chats; no delete, hard-deletion stays in dbpurge) move into the organization-member permission floor (OrgMemberPermissions). The agents-access built-in role, its assignment entries, and its name helpers are deleted. ReservedRoleName keeps agents-access reserved so a custom role cannot adopt the name and collide on rollback. Service accounts keep their own permission set (OrgServiceAccountPermissions) and do not receive chat access by default.
• Migration 000570: scrubs stored agents-access strings from organization_members.roles, users.rbac_roles, and organizations.default_org_member_roles; stale strings would otherwise fail role-update validation and render as raw labels in the UI. The down migration restores the role to all current non-service-account memberships so a rollback to an older binary preserves member chat access; org defaults are not restored because older binaries union them into service-account memberships too.
• SDK/frontend: codersdk.RoleAgentsAccess is retained as a deprecated constant for downstream Go consumers; types regenerated. Role description/sort metadata, MockAgentsAccessRole, and role-specific stories removed or repurposed. The frontend already gated on the createChat permission (not the role name), so it now lights up for all members with no logic change. The chat access denied alert keeps working for the remaining denial case (service accounts) and no longer points at a deleted docs anchor.
• Docs: the "Grant Coder Agents User" step is removed from the getting-started guide and the glossary entry is dropped. An upgrade note tells operators to drop agents-access from Terraform or scripted role sets, since role updates that still include it are rejected.
• Tests: role fixtures drop the grant; member-denial tests are repurposed as plain-member success, cross-user denial, or service-account denial coverage; TestListRoles, enterprise role listing, SSR permission, querier, migration, and Navbar/AgentCreateForm story tests updated.

Notes for reviewers

• Chat authorization is purely policy-driven on ResourceChat; no handler checked the role name, so removing the role only changes which subjects hold the permissions.
• Model configs, AI providers, and MCP server configs remain deployment-wide. The removed role never scoped them, so this change does not regress isolation; per-org admin controls remain future Admin Controls PRD work.

Remote dogfood UAT was run against this branch via a Coder Agent on dev.coder.com covering the plain-member happy path, role-list removal, migration scrubbing, and service-account denial.

Mux (AI agent) authored this PR on Mike's behalf.