feat: use AI provider keys at runtime (#25414)

coderd/database/dbauthz/dbauthz.go

@@ -710,6 +710,7 @@ var (
 				Identifier:  rbac.RoleIdentifier{Name: "chatd"},
 				DisplayName: "Chat Daemon",
 				Site: rbac.Permissions(map[string][]policy.Action{
+					rbac.ResourceAIProvider.Type:       {policy.ActionRead},
 					rbac.ResourceChat.Type:             {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
 					rbac.ResourceWorkspace.Type:        {policy.ActionRead, policy.ActionUpdate},
 					rbac.ResourceDeploymentConfig.Type: {policy.ActionRead},

coderd/database/dbgen/dbgen.go

@@ -225,6 +225,26 @@ func AIProviderKey(t testing.TB, db database.Store, seed database.AIProviderKey,
 	return key
 }
 
+// AIProviderWithOptionalKey inserts an AI provider and, when apiKey is not
+// empty, inserts a provider-scoped key for it.
+func AIProviderWithOptionalKey(
+	t testing.TB,
+	db database.Store,
+	seed database.AIProvider,
+	apiKey string,
+	munge ...func(*database.InsertAIProviderParams),
+) database.AIProvider {
+	t.Helper()
+	provider := AIProvider(t, db, seed, munge...)
+	if apiKey != "" {
+		AIProviderKey(t, db, database.AIProviderKey{
+			ProviderID: provider.ID,
+			APIKey:     apiKey,
+		})
+	}
+	return provider
+}
+
 func ChatProvider(t testing.TB, db database.Store, seed database.ChatProvider, munge ...func(*database.InsertChatProviderParams)) database.ChatProvider {
 	t.Helper()
 	params := database.InsertChatProviderParams{