feat: enforce per-user limits on user_secrets (#25588)

Add a Postgres trigger and matching codersdk constants that cap each
user's secrets in four dimensions: count (50), total stored value bytes
(200 KiB), env-injected stored value bytes (24 KiB), and env name length
(256 bytes). Without these caps a user could overflow the 4 MiB DRPC
agent manifest, the ~32 KiB Windows process env
block, or Linux/macOS ARG_MAX at workspace start. The trigger is the
source of truth on aggregates; the handler maps its check_violation
error into a 400 that names the per-user budget in stored
(post-encryption) bytes. A handler test exercises off-by-one at each cap
across POST and PATCH, plus per-user budget isolation.

Generated with help from Coder Agents.

docs/user-guides/user-secrets.md

@@ -77,6 +77,35 @@ example `~/config` and `/home/coder/config`), only one of them ends up on
 disk; the workspace agent logs a warning to help spot this. Use
 distinct paths to avoid the collision.
 
+## Limits
+
+User secrets are subject to the following limits. Coder enforces these when you
+create or update a secret and rejects the request with an explanatory 400 when
+you exceed one. Delete or shrink an existing secret to make room.
+
+| Cap                                      | Value     |
+|------------------------------------------|-----------|
+| Total secrets per user                   | 50        |
+| Combined stored value bytes per user     | 200 KiB   |
+| Combined stored env-injected value bytes | 24 KiB    |
+| Per-secret value bytes                   | 24 KiB    |
+| Env var name length                      | 256 bytes |
+
+Only secrets created with `--env` count against the env-injected budget. Coder
+injects these into the workspace agent's process environment, which on Windows
+has a ~32 KiB total budget. The 24 KiB ceiling leaves room for Coder's own
+variables (`CODER_*`, `PATH`, `HOME`, ...) plus any template-defined env. To
+inject a value larger than this budget, use `--file` instead; file secrets do
+not count against the env budget.
+
+The per-secret cap matches the env aggregate cap because a value larger than
+the env aggregate could never be injected successfully as an environment
+variable.
+
+These caps measure stored bytes, which is what Coder writes to the database.
+In deployments with secret encryption enabled, stored bytes exceed the raw
+value.
+
 ## Create a secret
 
 You can create, edit, and delete user secrets in the Coder dashboard. Click your