fix: backfill legacy Bedrock AI provider rows and stale model config strings (#26155)

Fixes CODAGT-548

Adds two idempotent startup backfills run after `newAPI():

- `BackfillBedrockProviderType`: promotes `ai_providers` rows from
`type=anthropic` with Bedrock settings to `type=bedrock`.
- `BackfillChatModelConfigProviderStrings`: fixes stale
`chat_model_configs.provider = "anthropic"` strings on rows whose linked
provider was just promoted.
- `UpdateAIProvider` query now also writes the `type` column, so the
fix persists on any subsequent PATCH.


> 🤖 Generated by Claude with oversight from a human.

enterprise/coderd/ai_providers_backfill_test.go

@@ -0,0 +1,51 @@
+package coderd_test
+
+import (
+	"crypto/rand"
+	"database/sql"
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"cdr.dev/slog/v3/sloggers/slogtest"
+	agplcoderd "github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/dbcrypt"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestBackfillBedrockProviderTypeEncryptedSettings(t *testing.T) {
+	t.Parallel()
+
+	rawDB, _ := dbtestutil.NewDB(t)
+	ctx := testutil.Context(t, testutil.WaitShort)
+	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true})
+
+	key := make([]byte, 32)
+	_, _ = rand.Read(key)
+	ciphers, err := dbcrypt.NewCiphers(key)
+	require.NoError(t, err)
+	cryptDB, err := dbcrypt.New(ctx, rawDB, ciphers...)
+	require.NoError(t, err)
+
+	rawSettings, err := json.Marshal(codersdk.AIProviderSettings{
+		Bedrock: &codersdk.AIProviderBedrockSettings{Region: "us-east-1"},
+	})
+	require.NoError(t, err)
+	provider := dbgen.AIProvider(t, cryptDB, database.AIProvider{
+		Type:     database.AiProviderTypeAnthropic,
+		Settings: sql.NullString{String: string(rawSettings), Valid: true},
+	})
+
+	agplcoderd.BackfillBedrockProviderType(ctx, cryptDB, logger)
+
+	// Verify via raw DB: type is not encrypted so it is directly readable.
+	row, err := rawDB.GetAIProviderByName(ctx, provider.Name)
+	require.NoError(t, err)
+	require.Equal(t, database.AiProviderTypeBedrock, row.Type, "encrypted legacy row must be promoted")
+	require.True(t, row.SettingsKeyID.Valid, "settings must remain encrypted after backfill")
+}

enterprise/coderd/x/chatd/chatd_test.go

@@ -200,6 +200,7 @@ func setOpenAIProviderBaseURL(
 		}
 		_, err = db.UpdateAIProvider(ctx, database.UpdateAIProviderParams{
 			ID:            provider.ID,
+			Type:          provider.Type,
 			DisplayName:   provider.DisplayName,
 			Enabled:       provider.Enabled,
 			BaseUrl:       baseURL,