perf: store workspace agent session counts as JSONB - #28126

Replaces the four session_count_* columns on workspace_agent_stats with a sparse session_counts JSONB object, so counting a new app needs no schema change.

• Only positive counts are stored, so an idle agent writes {} instead of four zeroes, and the template insights covering index drops four bigints from its INCLUDE list.
• The batcher normalizes and caps outside its lock, still ingests the deprecated fields from 2.10 agents, and marshals one object per row.
• Every reader and rollup moves to JSONB. Output column names and API shapes are unchanged.
• Resolves the session_count_sftp TODOs: a new session type is now a new key.

Migration

Converts the window DeleteOldWorkspaceAgentStats retains, MAX(template_usage_stats.start_time) minus one day. Anything older is already rolled up. When nothing has ever rolled up there is no watermark to fall back on, so every row converts instead of letting old activity roll up as zero minutes later.

A backlog the rollup never consumed spanning more than 24 hours usually means the rollup is failing or blocked. The migration proceeds anyway and emits a warning naming the span, with a hint to check coderd logs and pg_locks after the upgrade:

WARNING: migration 000590 found 30 days of workspace agent stats that template usage stats never rolled up

Measured on 10M rows: a healthy rollup converts ~330k rows in 11s on PG13 in Docker (4.44s on PG17 with tmpfs, 6.13s on durable storage). A rollup 30 days behind, or a deployment that never rolled up, converts all 10M rows in about 3.5 minutes, roughly 21 seconds per million backlogged rows.

Trade-offs

• The conversion is unbounded and holds ACCESS EXCLUSIVE, so agent stat writes block for its duration; DROP COLUMN and the index rebuild need the lock regardless. A deployment whose rollup has failed for months converts its whole backlog at ~21s per million rows. The alternative, aborting until the rollup is fixed, blocked the upgrade with no way to trigger a rollup on demand.
• jsonb parsing on a hot read path. UpsertTemplateUsageStats extracts keys per row, every five minutes over the retained window, where it compared four integers. Neither form was indexed; the cost buys schema-free new apps.
• Three queries change plan shape, not just their column expressions, so a regression is harder to attribute. Family grouping in feat: attribute session counts by app family #28337 needs one pass per row, and doing it here avoids rewriting the same blocks twice.
• One PR. The migration drops the columns, so splitting it leaves either old code on the new schema or new queries on a missing column.
• Rollback discards unknown keys. The down migration restores the four known fields only; nothing else has a column to land in.

Depends on #28125. Phase 3 of #27410.