feat: log tailnet tunnels to the connection log - #27423

Address review feedback on the original changeset:

- Rebase onto main and renumber the migration to 000551 to resolve the
  collision with 000539_ai_provider_icons.
- Rename the connection_type value tailnet to tunnel across the
  migration, codersdk, enterprise converter, and frontend, since the
  enum value is permanent API surface and should name the event rather
  than the transport.
- Implement a real down migration that recreates connection_type
  without the tunnel value, following the pattern in
  000533_nats_ca_crypto_key_feature.down.sql.
- Update the remaining connection_logs column comments (slug_or_port,
  disconnect_time, disconnect_reason) to the agent-reported vs
  coderd-reported taxonomy.
- Extract the connection log write into api.logTunnelConnection and
  bound it with a 3s timeout so connection log backpressure cannot
  stall tunnel establishment.
- Cover the status-filter exclusion with a tunnel fixture in
  TestConnectionLogsOffsetFilters and the WebInfo mapping with a
  WebInfoTunnel subtest.
- Harden the coordinate test: testutil.Context, AwaitReachable
  assertion, Code/ConnectionStatus expectations, and a second dial
  asserting each handshake produces its own row.
- Document tunnel connections and their semantics in
  docs/admin/monitoring/connection-logs.md.
- Clarify the connectionTypeIsWeb helper and replace the unreachable
  Unauthenticated user copy in the tunnel description branch.

Co-authored-by: Chris DiGiamo <cdigiamo@anthropic.com>

Reuse the workspace_app_audit_sessions mechanism to collapse tunnel
reconnections into one connection log row per active session. Clients
automatically re-dial the coordinate endpoint after network blips, load
balancer timeouts, and coderd restarts, so logging every handshake
would flood the connection log with reconnect noise that is
indistinguishable from genuine user activity.

Tunnel sessions are keyed on (agent, user, IP, user agent) with
app_id = uuid.Nil and an empty slug, matching how port forwarding uses
the table; status code 101 keeps them from colliding with app sessions.
A new row is logged only when no session exists for the key or the
session has been idle past the stale interval (1 hour by default,
sliding). On dedup failure the log write is skipped, matching the
workspace app precedent of not spamming the connection log during
database problems.

Removing an enum value requires recreating connection_type and
rewriting the connection_logs type column, which takes an exclusive
lock on the table and would have to delete all tunnel rows because
they cannot exist in the old type. Leaving the value in place is
harmless and matches the precedent of other enum-value additions.

Explain how the status code keeps tunnel audit sessions from
colliding with app and port forwarding sessions: the status code is
part of the session unique key, and app sessions record the token
authorization status (200, 4xx) while tunnel sessions always record
101, so the keys can never conflict.

Drop the redundant 'failed' suffix from the error log messages; the
Error level already implies failure.

…dline

Renumber the tunnel enum migration from 000551 to 000556 after rebasing
onto main, which gained migrations 000551 through 000555.

Give the connection log enqueue its own 3s deadline detached from the
audit session upsert's budget. Sharing one deadline meant a slow
session upsert could exhaust it before the enqueue ran, committing the
session row with no log row written; the active session would then
suppress retries for the entire stale interval, dropping the tunnel
from the audit log for up to an hour after the database recovered.

…tion

Keep the migration to the enum addition only. The prior comment
rewording was cosmetic and added churn to both the up and down
migrations.

Use one named writeCtx for both the audit session upsert and the
connection log enqueue instead of a shadowed ctx plus a separate
enqueue deadline, inline the system-restricted context, and rename
newOrStale to newSession. The shared-budget tradeoff (a slow session
upsert can drop the log row until the session goes stale) is
documented at the timeout.

Main gained 000556_user_secrets_enabled.