feat: route chatd provider traffic through aibridge (#25629)

## Summary

Routes chatd model calls backed by concrete AI Provider rows through the
in-process aibridge transport by default, with deployment options to use
direct provider routing when AI Gateway is disabled or chat AI Gateway
routing is disabled.

- Splits model routing into common, direct provider, and AI Gateway
paths behind a single deployment-mode entry point.
- Builds chatd models through explicit request, route, and options data.
Active API key attribution is passed explicitly instead of being hidden
inside generic model construction.
- For AI Gateway BYOK routes, resolves the user's provider key in chatd,
forwards it through provider-specific auth headers, and sets
`X-Coder-AI-Governance-Token` to the `delegated` marker so aibridge
preserves those headers while still stripping Coder-specific metadata.
- Keeps central provider credentials and deployment fallback credentials
out of forwarded provider auth headers, so AI Gateway central policy
remains authoritative.
- Redacts delegated provider auth from default string formatting to
avoid accidental plaintext logging of user BYOK credentials.
- Covers selected chat models, advisor overrides, title and quickgen
paths, subagent overrides, computer use model selection, and an
integration-style chat turn through the aibridge transport path.
- Persists initiating API key IDs on chat and queued user messages,
including subagent child messages, and fails closed for AI
Gateway-routed model builds without an active key.
- Removes unused `api_key_id` indexes while keeping the persistence
columns and foreign keys.
- Keeps the deployment option available through config and env parsing,
but hides it from CLI help and generated docs.
- Stabilizes the subagent poll fallback test so background CreateChat
processing cannot win the state transition under slower CI environments.

## Tests

- `go test ./coderd/x/chatd -run
'TestAIGatewayProviderAuthForUser|TestAIGatewayProviderAuthRedactsFormatting|TestResolveModelRouteForConfigAIGatewayProviderAuth|TestAIGatewayModelForwardsProviderAuth|TestProcessChat_AIGatewayRoutingUsesDelegatedAPIKey|TestAwaitSubagentCompletion'
-count=1`
- `go test ./coderd/aibridged -run
'TestServeHTTP_DelegatedAPIKey|TestServeHTTP_StripCoderToken' -count=1`
- `git diff --check HEAD~1..HEAD`
- `make lint`

> Mux working on behalf of Mike.

coderd/x/chatd/chatd_debug.go

@@ -2,14 +2,11 @@ package chatd
 
 import (
 	"context"
-	"net/http"
 	"time"
 
 	"charm.land/fantasy"
-	"golang.org/x/xerrors"
 
 	"cdr.dev/slog/v3"
-	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/x/chatd/chatdebug"
 	"github.com/coder/coder/v2/coderd/x/chatd/chatprovider"
 )
@@ -109,53 +106,38 @@ func (p *Server) scheduleDebugCleanup(
 	}()
 }
 
-func (p *Server) newDebugAwareModelFromConfig(
+func (p *Server) newDebugAwareModel(
 	ctx context.Context,
-	chat database.Chat,
-	providerHint string,
-	modelName string,
-	providerKeys chatprovider.ProviderAPIKeys,
-	userAgent string,
-	extraHeaders map[string]string,
+	req modelClientRequest,
+	route resolvedModelRoute,
+	opts modelBuildOptions,
 ) (fantasy.LanguageModel, bool, error) {
-	provider, resolvedModel, err := chatprovider.ResolveModelWithProviderHint(modelName, providerHint)
+	providerHint, err := route.providerHint()
 	if err != nil {
 		return nil, false, err
 	}
+	provider, resolvedModel, err := chatprovider.ResolveModelWithProviderHint(req.ModelName, providerHint)
+	if err != nil {
+		return nil, false, err
+	}
+	route = route.withProviderHint(provider)
+	req.ModelName = resolvedModel
 
 	debugSvc := p.debugService()
-	debugEnabled := debugSvc != nil && debugSvc.IsEnabled(ctx, chat.ID, chat.OwnerID)
+	debugEnabled := debugSvc != nil && debugSvc.IsEnabled(ctx, req.Chat.ID, req.Chat.OwnerID)
+	opts.RecordHTTP = debugEnabled
 
-	var httpClient *http.Client
-	if debugEnabled {
-		httpClient = &http.Client{Transport: &chatdebug.RecordingTransport{}}
-	}
-
-	model, err := chatprovider.ModelFromConfig(
-		provider,
-		resolvedModel,
-		providerKeys,
-		userAgent,
-		extraHeaders,
-		httpClient,
-	)
+	model, err := p.newModel(ctx, req, route, opts)
 	if err != nil {
 		return nil, debugEnabled, err
 	}
-	if model == nil {
-		return nil, debugEnabled, xerrors.Errorf(
-			"create model for %s/%s returned nil",
-			provider,
-			resolvedModel,
-		)
-	}
 	if !debugEnabled {
 		return model, false, nil
 	}
 
 	return chatdebug.WrapModel(model, debugSvc, chatdebug.RecorderOptions{
-		ChatID:   chat.ID,
-		OwnerID:  chat.OwnerID,
+		ChatID:   req.Chat.ID,
+		OwnerID:  req.Chat.OwnerID,
 		Provider: provider,
 		Model:    resolvedModel,
 	}), true, nil