feat: add chat model config RBAC resource (#27957)

Add the `chat_model_config` RBAC resource, actions, and API key scopes.
This layer includes the scope migration and generated API types. Model
list queries apply token scopes, SQL authorization filters, and row
ACLs.

Write and default-management handlers keep deployment configuration
authorization until the next API layer replaces it.

Depends on #27956

_This pull request description was generated by Coder Agents._

coderd/database/migrations/000581_chat_model_config_scopes.down.sql

@@ -0,0 +1,2 @@
+-- Enum additions to api_key_scope are intentionally not reverted because
+-- Postgres cannot drop enum values safely.

coderd/database/migrations/000581_chat_model_config_scopes.up.sql

@@ -0,0 +1,6 @@
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'chat_model_config:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'chat_model_config:create';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'chat_model_config:read';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'chat_model_config:update';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'chat_model_config:delete';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'chat_model_config:share';

coderd/database/migrations/000582_audit_chat_model_config.down.sql

@@ -0,0 +1 @@
+-- No-op, enum values can't be dropped.

coderd/database/migrations/000582_audit_chat_model_config.up.sql

@@ -0,0 +1,2 @@
+ALTER TYPE resource_type
+	ADD VALUE IF NOT EXISTS 'chat_model_config';