fix: allow Agents access via user-level coast-access [FIX-416]

[liamcervante]

What

The CLI half of FIX-416. The dashboard currentUser query now returns agentsEnabled at the user level as well as per-org (dashboard PR: infracost/dashboard#5248). This wires the CLI to honour it.

The coast-access entitlement can target a user directly or their org. Previously the CLI only gated the Agents surfaces (findings / tasks / actions and their MCP tools) on the active org's flag, so a user with the entitlement whose org didn't have it was denied access.

Now: if Agents is enabled for the user it is always-on regardless of the active org; otherwise we fall back to the active org's flag.

Changes

• internal/api/dashboard/client.go: select the new user-level agentsEnabled and add CurrentUser.AgentsEnabled.
• pkg/auth/user_cache.go: add UserCache.AgentsEnabled.
• internal/cmds/org.go: cacheUser persists the user-level flag; applyActiveOrg computes cfg.AgentsEnabled = org.AgentsEnabled || uc.AgentsEnabled; applyActiveOrg/applyActiveOrgByID thread the UserCache through.
• internal/cmds/mcp.go: setOrg passes the UserCache through so mid-session org switches keep the user-level grant.
• internal/config/config.go: doc update for AgentsEnabled.

Tests

New internal/cmds/org_agents_test.go:

• TestApplyActiveOrg_AgentsEnabled — the OR gate (neither / org-only / user-only always-on / both).
• TestApplyActiveOrgByID — user-level grant enables the gate even when the active org has it off; org-flag fallback; defensive unknown-id path.
• TestCacheUser_PersistsAgentsEnabled — the user-level flag round-trips from the currentUser response through the on-disk cache.

go build ./..., go test ./internal/cmds/, gofmt -l, and golangci-lint all clean.

Ref: FIX-416