feat: add chat model config RBAC resource (#27957)

Add the `chat_model_config` RBAC resource, actions, and API key scopes.
This layer includes the scope migration and generated API types. Model
list queries apply token scopes, SQL authorization filters, and row
ACLs.

Write and default-management handlers keep deployment configuration
authorization until the next API layer replaces it.

Depends on #27956

_This pull request description was generated by Coder Agents._

codersdk/apikey_scopes_gen.go

@@ -59,6 +59,12 @@ const (
 	APIKeyScopeChatRead                            APIKeyScope = "chat:read"
 	APIKeyScopeChatShare                           APIKeyScope = "chat:share"
 	APIKeyScopeChatUpdate                          APIKeyScope = "chat:update"
+	APIKeyScopeChatModelConfigAll                  APIKeyScope = "chat_model_config:*"
+	APIKeyScopeChatModelConfigCreate               APIKeyScope = "chat_model_config:create"
+	APIKeyScopeChatModelConfigDelete               APIKeyScope = "chat_model_config:delete"
+	APIKeyScopeChatModelConfigRead                 APIKeyScope = "chat_model_config:read"
+	APIKeyScopeChatModelConfigShare                APIKeyScope = "chat_model_config:share"
+	APIKeyScopeChatModelConfigUpdate               APIKeyScope = "chat_model_config:update"
 	APIKeyScopeCoderAll                            APIKeyScope = "coder:all"
 	APIKeyScopeCoderApikeysManageSelf              APIKeyScope = "coder:apikeys.manage_self"
 	APIKeyScopeCoderApplicationConnect             APIKeyScope = "coder:application_connect"
@@ -257,6 +263,8 @@ var PublicAPIKeyScopes = []APIKeyScope{
 	APIKeyScopeApiKeyDelete,
 	APIKeyScopeApiKeyRead,
 	APIKeyScopeApiKeyUpdate,
+	APIKeyScopeChatModelConfigRead,
+	APIKeyScopeChatModelConfigShare,
 	APIKeyScopeCoderAll,
 	APIKeyScopeCoderApikeysManageSelf,
 	APIKeyScopeCoderApplicationConnect,

codersdk/audit.go

@@ -54,6 +54,7 @@ const (
 	ResourceTypeUserAIBudgetOverride    ResourceType = "user_ai_budget_override"
 	ResourceTypeChat                    ResourceType = "chat"
 	ResourceTypeMCPServerConfig         ResourceType = "mcp_server_config"
+	ResourceTypeChatModelConfig         ResourceType = "chat_model_config"
 	ResourceTypeUserSecret              ResourceType = "user_secret"
 	ResourceTypeUserSkill               ResourceType = "user_skill"
 	ResourceTypeChatInstructionSettings ResourceType = "chat_instruction_settings"
@@ -133,6 +134,8 @@ func (r ResourceType) FriendlyString() string {
 		return "chat"
 	case ResourceTypeMCPServerConfig:
 		return "mcp server config"
+	case ResourceTypeChatModelConfig:
+		return "chat model config"
 	case ResourceTypeUserSecret:
 		return "user secret"
 	case ResourceTypeUserSkill:

codersdk/rbacresources_gen.go

@@ -17,6 +17,7 @@ const (
 	ResourceBoundaryLog                   RBACResource = "boundary_log"
 	ResourceBoundaryUsage                 RBACResource = "boundary_usage"
 	ResourceChat                          RBACResource = "chat"
+	ResourceChatModelConfig               RBACResource = "chat_model_config"
 	ResourceConnectionLog                 RBACResource = "connection_log"
 	ResourceCryptoKey                     RBACResource = "crypto_key"
 	ResourceDebugInfo                     RBACResource = "debug_info"
@@ -97,6 +98,7 @@ var RBACResourceActions = map[RBACResource][]RBACAction{
 	ResourceBoundaryLog:                   {ActionCreate, ActionDelete, ActionRead},
 	ResourceBoundaryUsage:                 {ActionDelete, ActionRead, ActionUpdate},
 	ResourceChat:                          {ActionCreate, ActionDelete, ActionRead, ActionShare, ActionUpdate},
+	ResourceChatModelConfig:               {ActionCreate, ActionDelete, ActionRead, ActionShare, ActionUpdate},
 	ResourceConnectionLog:                 {ActionRead, ActionUpdate},
 	ResourceCryptoKey:                     {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
 	ResourceDebugInfo:                     {ActionRead},