Adds GetAIProvidersForRotation and UpdateAIProviderEncryptedColumns
queries (and their dbauthz/dbcrypt wrappers) so the Rotate, Decrypt,
and Delete utilities walk the ai_providers table alongside every other
encrypted table.

Previously, key revocation failed with a foreign-key violation when
ai_providers rows still referenced the old key's digest:

    error: rotate ciphers: revoke key: pq: update or delete on table
    "dbcrypt_keys" violates foreign key constraint
    "ai_providers_api_key_key_id_fkey" on table "ai_providers"

Soft-deleted rows are also walked because their FK references persist
until the row itself is hard-deleted.

…erated artifacts

The TestRolePermissions/aibridge_provider-AllActions check failed
because no test case covered the new aibridge_provider resource. Add
an owner-only CRUD case alongside the existing AIBridgeInterception
entries.

Also refreshes the generated artifacts that the previous "make gen"
run missed because of stale build timestamps:

- coderd/apidoc/docs.go and swagger.json
- codersdk/apikey_scopes_gen.go
- docs/admin/security/audit-logs.md
- docs/reference/api/schemas.md
- site/src/api/typesGenerated.ts

These all needed to pick up the aibridge_provider resource and the
AiProvider audit table entry that PR 24892 introduced.

Per the updated RFC, ai_providers no longer carries the api_key column.
Instead a new ai_provider_keys table holds 0..N keys per provider:

- Bedrock providers have 0 keys; their AWS credentials live in
  ai_providers.settings (bedrock_access_key + bedrock_access_key_secret).
- OpenAI/Anthropic providers have 1..N keys to support future failover
  and rotation.

Changes:

- Migration 000483: drop api_key/api_key_key_id from ai_providers; add
  ai_provider_keys(id, provider_id FK ON DELETE CASCADE, api_key,
  api_key_key_id, timestamps).
- Queries split: aibridgeproviders.sql for the provider row,
  aibridgeproviderkeys.sql for the keys.
- dbauthz: new key queries gated on ResourceAibridgeProvider.
- dbcrypt: provider rotation walks only settings now; new key rotation
  walks ai_provider_keys including those whose provider is soft-deleted.
- audit: new AiProviderKey row tracks Create/Delete with api_key marked
  ActionSecret.
- dbgen: new AIProviderKey factory.
- Tests: TestAIProviderKeys (round-trip), TestRotateAIProviderKeys
  (rotation including soft-deleted parent provider), and the existing
  AIProvider tests rewritten without the api_key field.
- make gen refreshes all derived artifacts.

Renames SoftDeleteAIProviderByID -> DeleteAIProviderByID,
UpdateAIProviderEncryptedColumns -> UpdateAIProviderSettings,
GetAIProviderKeysForRotation -> GetAIProviderKeys, and
UpdateAIProviderKeyEncryptedColumns -> UpdateEncryptedAIProviderKey.
Drops GetAIProviderByNameIncludeDeleted, GetEnabledAIProviders, and
GetAIProvidersForRotation; GetAIProviders now accepts optional
enabled/deleted filters that the dbcrypt rotation walks with both
flags NULL.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Renames the new RBAC resource so it can be used by all AI-related
features, not just AI Bridge. Sets Name: "AIProvider" on the policy
entry so the generated Resource* constants use AI; adds sqlc.yaml
renames so the database struct types follow suit. Generator-derived
ScopeAi*/APIKeyScopeAi* constants are left as-is.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ring

Re-running make gen revealed three issues left by earlier commits on this
branch. The apidoc, swagger, audit-logs, RBAC, and codersdk type artifacts
were stale relative to the @Router/@basepath, RBAC, and codersdk changes
that landed in 74a413d and the commits leading up to it. The AIProvider
rename missed the AuditActionMap keys, which are looked up case-sensitively
by the audit doc generator and so rendered the AI rows with empty actions.
dbgen.AIProviderKey did not set the CreatedAt sql.NullTime field that
InsertAIProviderKeyParams gained, tripping exhaustruct.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Renames query files, migration files, and Go symbols to drop the
"aibridge" prefix for the generic AI provider concept. Adds a missing
dbcrypt override on DeleteAIProviderByID so soft-deleted rows return
decrypted settings, matching sibling methods.

Env vars (CODER_AIBRIDGE_PROVIDER_<N>_<KEY>) and aibridgeproxyd symbols
are intentionally left unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

sqlc orders queries.sql.go by source filename; renaming
aibridgeproviders.sql / aibridgeproviderkeys.sql to ai_providers.sql /
ai_provider_keys.sql shifts those query blocks ahead of aibridge.sql in
the generated output. Pure reorder: 1673 lines moved, no content
changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The column is now nullable text with no default; callers fall back to
name when display_name is NULL. The dbgen test factory mirrors this by
seeding display_name from the provider name when none is supplied.

The previous 8-character prefix was lossy. Surface the full provider
UUID so audit consumers can correlate the key back to its provider
without guessing.

…ncryptedAIProviderSettings

Mirrors UpdateEncryptedAIProviderKey on ai_provider_keys; the name now
makes clear that the query targets the encrypted settings columns and
is intended for the dbcrypt rotation utility.

Signed-off-by: Danny Kopping <danny@coder.com>