Add aibridged.NewWebsocketDialer, which connects to coderd's
/api/v2/aibridge/serve endpoint over a WebSocket, multiplexes it with
yamux, and returns a DRPCClient exposing the Recorder, MCPConfigurator
and Authorizer services. It is the standalone counterpart to the
in-memory pipe used by the embedded daemon.

Authentication uses the AI Gateway key header; the API version is sent as
a query parameter and the build version as a header. Failed upgrades are
returned as *codersdk.Error so the daemon's connect loop can tell fatal
auth/entitlement failures apart from transient ones.

Co-authored-by: Coder Agent <agent@coder.com>

Add the standalone AI Gateway command under the existing 'coder
ai-gateway' group. It connects to coderd over DRPC via
/api/v2/aibridge/serve for authentication, recording and MCP
configuration, builds providers from deployment configuration, and serves
incoming LLM client traffic on its own HTTP listener (with optional TLS
termination). Request interception and recording behave the same as the
embedded daemon, which it reuses directly.

The daemon is served at the listener root, with an /api/v2/aibridge alias
for parity with the embedded route. Standalone-specific options use the
CODER_AI_GATEWAY_* prefix; all other AI Gateway config options are shared
with embedded mode.

Health endpoints, metrics, tracing, structured logging, live provider
reload and E2E tests are intentionally out of scope and will follow.

Co-authored-by: Coder Agent <agent@coder.com>

The connect loop warns when a dial fails but previously logged a
successful connect at debug, so a standalone gateway recovering from a
transient coderd outage produced no visible signal. Log the (re)connection
at info so the warning on failure is paired with a clear restoration
message. Resolves the long-standing TODO now that external gateways exist.

Co-authored-by: Coder Agent <agent@coder.com>