feat: hot-reload aibridged and aibridgeproxyd providers on DB changes (#25673)

Previously the in-process aibridge daemon and the enterprise aibridgeproxy daemon both snapshotted their provider routing once at boot. Any `ai_providers` or `ai_provider_keys` mutation required a restart for either to pick it up.

Add an `ai_providers_changed` pubsub channel that the CRUD handlers publish on after Create / Update / Delete. Both daemons subscribe:

- **aibridged** rebuilds its `[]aibridge.Provider` snapshot via `BuildProviders` and swaps it into the pool atomically. Inflight requests keep serving against the bridge they already acquired; new acquires build against the new snapshot. Per-provider construction errors stay scoped to the offending row.
- **aibridgeproxyd** rebuilds its routing snapshot from `GetAIProviders` and swaps the host→provider map atomically. The MITM listener picks up new providers without restart.

DB read for aibridgeproxyd uses the existing `AsAIProviderMetadataReader` subject for routing-only access.

coderd/pubsub/aiproviderschangedevent.go

@@ -0,0 +1,11 @@
+package pubsub
+
+// AIProvidersChangedChannel is the pubsub channel that carries AI
+// provider lifecycle events: provider create / update / soft-delete
+// and key insert / delete. Subscribers (aibridged, aibridgeproxyd)
+// reload their in-memory provider snapshot on receipt.
+//
+// The payload is an empty invalidation hint; subscribers refetch the
+// authoritative state from the database, so dropped messages only
+// delay convergence rather than diverge state.
+const AIProvidersChangedChannel = "ai_providers_changed"