feat: add ai_gateway_keys table and related RBAC (#25563)

Adds table to store keys that AI Gateway standalone replicas will use
to authenticate into Coderd.
Also adds RBAC and audit boilerplate.

coderd/database/migrations/000514_ai_gateway_keys.down.sql

@@ -0,0 +1,6 @@
+-- Enum additions to resource_type and api_key_scope are intentionally not
+-- reverted because Postgres cannot drop enum values safely.
+DROP INDEX IF EXISTS ai_gateway_keys_hashed_secret_idx;
+DROP INDEX IF EXISTS ai_gateway_keys_secret_prefix_idx;
+DROP INDEX IF EXISTS ai_gateway_keys_name_idx;
+DROP TABLE IF EXISTS ai_gateway_keys;

coderd/database/migrations/000514_ai_gateway_keys.up.sql

@@ -0,0 +1,25 @@
+CREATE TABLE ai_gateway_keys (
+    id uuid PRIMARY KEY,
+    created_at timestamptz NOT NULL,
+    name text NOT NULL,
+    secret_prefix varchar(11) NOT NULL,
+    hashed_secret bytea NOT NULL,
+    last_used_at timestamptz NULL,
+    CONSTRAINT ai_gateway_keys_name_check CHECK (length(name) <= 64 AND name ~ '^[a-z0-9]+(-[a-z0-9]+)*$'),
+    CONSTRAINT ai_gateway_keys_secret_prefix_check CHECK (length(secret_prefix) = 11),
+    CONSTRAINT ai_gateway_keys_hashed_secret_check CHECK (length(hashed_secret) > 0)
+);
+
+COMMENT ON TABLE ai_gateway_keys IS 'Hashed bearer secrets used by AI Gateway standalone replicas to authenticate into coderd.';
+COMMENT ON COLUMN ai_gateway_keys.secret_prefix IS 'Public token prefix for display and audit correlation. Auth uses hashed_secret.';
+
+CREATE UNIQUE INDEX ai_gateway_keys_name_idx ON ai_gateway_keys USING btree (lower(name));
+CREATE UNIQUE INDEX ai_gateway_keys_secret_prefix_idx ON ai_gateway_keys USING btree (secret_prefix);
+CREATE UNIQUE INDEX ai_gateway_keys_hashed_secret_idx ON ai_gateway_keys USING btree (hashed_secret);
+
+ALTER TYPE resource_type ADD VALUE IF NOT EXISTS 'ai_gateway_key';
+
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'ai_gateway_key:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'ai_gateway_key:create';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'ai_gateway_key:delete';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'ai_gateway_key:read';

coderd/database/migrations/testdata/fixtures/000514_ai_gateway_keys.up.sql

@@ -0,0 +1,15 @@
+INSERT INTO ai_gateway_keys (
+	id,
+	created_at,
+	name,
+	secret_prefix,
+	hashed_secret,
+	last_used_at
+) VALUES (
+	'8b6f0a82-9a3a-4d2e-8c0c-2c9c9b9b1a01',
+	'2026-05-21 00:00:00+00',
+	'example-key',
+	'cdr_1234567',
+	'\x00'::bytea,
+	NULL
+);