feat(coderd): accept delegated API key ID from in-process aibridge callers (#25625)

Allows an `api_key_id` to be passed from a trusted in-memory transport
(currently: `chatd`) to `aibridged` for use in authenticating LLM
requests.

This value can _only_ be passed via context, and all users of the
in-memory transport _must_ provide it.

It can be used in conjunction with BYOK headers.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

coderd/aibridge/factory.go

@@ -31,6 +31,27 @@ func SourceFromContext(ctx context.Context) Source {
 	return src
 }
 
+type delegatedAPIKeyIDCtxKey struct{}
+
+// WithDelegatedAPIKeyID returns a copy of ctx carrying an API key ID on whose
+// behalf the request is being made. The in-process aibridge transport requires
+// this on every RoundTrip and rejects calls whose context lacks it.
+//
+// The caller is responsible for having established that the user owning this
+// key authorized the request: aibridged validates only that the key exists,
+// has not expired, and belongs to a non-deleted, non-system user. It does not
+// verify the key secret, because the caller never has it.
+func WithDelegatedAPIKeyID(ctx context.Context, id string) context.Context {
+	return context.WithValue(ctx, delegatedAPIKeyIDCtxKey{}, id)
+}
+
+// DelegatedAPIKeyIDFromContext returns the API key ID attached by
+// [WithDelegatedAPIKeyID] and whether a non-empty value was set.
+func DelegatedAPIKeyIDFromContext(ctx context.Context) (string, bool) {
+	id, ok := ctx.Value(delegatedAPIKeyIDCtxKey{}).(string)
+	return id, ok && id != ""
+}
+
 // TransportFactory returns an [http.RoundTripper] that dispatches an aibridge
 // request in-process for a given ai_providers row.
 //