Implements automatic license import from a file during server startup,addressing the need for automated license deployment in Helm/Kubernetesenvironments without requiring admin API tokens.**Backend Changes:**- Add `LicenseFile` configuration option to deployment settings- Implement `ImportLicenseFromFile()` function in enterprise/coderd/licenses.go- Integrate license import into server startup flow in enterprise/cli/server.go- Use system context with wildcard RBAC permissions for startup operations**Helm Chart Changes:**- Add license secret configuration to values.yaml- Mount license secret as volume in pod- Set CODER_LICENSE_FILE environment variable when secret is configured**Key Features:**- Idempotent: only imports when no licenses exist- Validates license JWT signature and deployment ID restrictions- Proper error handling and logging- Works with CLI flag, environment variable, or Helm secrets- No authentication required (runs during server startup)Resolves:#20259🤖 Generated with [Claude Code](https://claude.com/claude-code)Co-Authored-By: Claude <noreply@anthropic.com>

…not no users

…se importReplace wildcard permissions with least-privilege approach:- Only grant ActionCreate and ActionRead on ResourceLicense- Removes unnecessary access to all other resources- Follows principle of least privilege- Reduces attack surface if code is refactoredThe license import operation only needs to:1. Read existing licenses (ActionRead)2. Create new license (ActionCreate)No other permissions are required, so wildcard was unnecessarily broad.

…or license import"This reverts commit53a659f.

…se importReplace wildcard permissions with least-privilege approach:- Only grant ActionCreate and ActionRead on ResourceLicense- Removes unnecessary access to all other resources- Follows principle of least privilegeThe license import operation only needs to:1. Read existing licenses (ActionRead on License)2. Create new license (ActionCreate on License)

Add 12 test cases covering:- Successful license import on first startup- Idempotency (skips re-import when licenses exist)- Empty file path handling- Missing file handling (file doesn't exist)- Empty file content- Whitespace-only file content- Invalid license JWT format- Deployment ID restrictions (both mismatch and match)- Expired license handling- License UUID preservation- Skipping import when licenses already exist in databaseTests validate proper error handling, file I/O, license validation,and idempotent behavior. All tests use proper parallel executionand follow existing codebase patterns.

- Fix gocritic lint error by renaming license_uuid to license_uuid_id- Fix helm template nil pointer by adding existence check for coder.license values

Expired licenses are properly rejected by the license parser as they failvalidation. Updated the test to expect an error and verify no license isimported, which is the correct behavior.

Changed from 'and' conditionals to 'with' statements to safely handleoptional nested values. This prevents nil pointer errors when thecoder.license object doesn't exist in values, while still properlyhandling the license configuration when it is provided.