The provider/keys CRUD does not depend on enterprise; move the
handlers, route registration, and tests into the AGPL package so
the feature ships in OSS.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ruleguard requires uuid.UUID fields in slog records to use the
"_id" suffix. Rename the per-row log key from "id" to "provider_id".
Regenerate the API reference so the widened ai_provider_type enum
appears in the docs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ints

Drop the /keys sub-resource. POST/PATCH /ai/providers now carry the
plaintext api_keys list and replace the provider's keys atomically
inside a named transaction. GET responses return masked keys via
aibridge utils.MaskSecret, so the on-disk split between ai_providers
and ai_provider_keys is no longer surfaced to API consumers. Bedrock
providers continue to reject any non-empty api_keys.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Replace the ad hoc strDeref/boolDeref helpers with the existing generic
ptr.NilToDefault. Inline nullStrDeref since its *string -> sql.NullString
conversion doesn't fit the generic shape and it was only used once.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…list

The list/get response now returns each API key as {id, masked,
created_at} so clients can reference an existing row without
re-sending its plaintext. The PATCH api_keys field becomes a list of
AIProviderKeyMutation entries with exactly one of id or api_key set:
id keeps the existing key, api_key adds a new plaintext, omitted IDs
are deleted. Unknown IDs and duplicate IDs return 400 without
modifying any rows.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Previously, a path like /api/v2/ai/providers/Bad_Name returned 404
because the regex check in lookupAIProvider produced sql.ErrNoRows.
Surface a dedicated sentinel and translate it to 400 so integrators
get a hint about the path shape instead of a misleading "not found".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…oviders

The runtime dispatches by provider Type, so a Bedrock block on an
OpenAI-typed provider would sit encrypted in the database, unused. The
operator's authentication intent is silently dropped.

Cross-validate on create via codersdk Validate, and on update after the
patch is merged into the existing row's decoded settings.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Keys are stored verbatim. A value like " sk-real " passes the old
non-empty check but is then sent to OpenAI/Anthropic literally,
producing a 401 the operator has no signal about. Reject at the
validation boundary so the operator gets a clear error instead of a
masked-looking-correct credential.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Previously, mergeAIProviderSettings treated an empty-string AccessKey
or AccessKeySecret as "leave existing value alone." That made it
impossible to migrate from static AWS credentials to IAM role-based
auth in a single PATCH: the only workaround was to clear settings
entirely (which also wiped Region and Model), then re-PATCH the
non-secret fields.

Switch both fields to pointers so the merge can distinguish "omitted"
(nil, keep existing) from "explicitly clear" (non-nil empty string).
Add internal unit tests covering preserve, rotate, and clear paths.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

GetAIProviderKeys was a bare SELECT * over ai_provider_keys, returning
keys for soft-deleted providers too. Each call decrypted every row,
and the API list handler then discarded keys whose provider was gone
— so as soft-deleted providers accumulated, the decrypt work grew
monotonically.

Add an include_deleted parameter to the query. The list handler passes
false (default behaviour now: live providers only); the dbcrypt key
rotation utility passes true so it can still re-encrypt every FK
reference to dbcrypt_keys.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

… paths

- Replace writeAIProviderLookupError with writeAIProviderError, which
  takes parameterized log/response messages. The update handler now
  surfaces a message about updating, not fetching, when the inner
  tx.UpdateAIProvider or encodeAIProviderSettings call fails.
- Use errAIProviderKeyUnknown.Error() directly in the 400 body so the
  "execute transaction:" wrapper xerrors adds inside InTx does not
  leak to the API consumer.
- Drop the unreachable sql.ErrNoRows branch in the delete handler;
  DeleteAIProviderByID is :exec on a soft-delete UPDATE, which never
  returns that sentinel and is already idempotent.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ck secret redaction

The previous test substrings ("bedrock_access_key", "bedrock_access_key_secret")
do not appear in the JSON wire form, which uses access_key and
access_key_secret. The assertions passed vacuously and would not have
caught a redaction regression. Use the real field names with quotes to
avoid matching unrelated substrings.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>