feat(enterprise/dbcrypt): encrypt ai_providers and ai_provider_keys at rest - #25326

…t rest

Adds dbcrypt overrides for the ai_providers.settings and
ai_provider_keys.api_key columns so secrets are encrypted at rest on
deployments configured with CODER_EXTERNAL_TOKEN_ENCRYPTION_KEYS.

Includes key-rotation support in cliutil.Rotate so existing rows are
re-encrypted with the new primary cipher, and a DeleteAIProviderByID
override so soft-deleted rows return decrypted fields like every other
read path.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

…oader coverage

The cliutil tests added in dcdf9cf covered ai_providers only, while
none of the other dbcrypt-managed tables (user_links,
external_auth_links, chat_providers, user_secrets, etc.) have any
cliutil coverage. Drop them so the gap can be closed comprehensively
rather than per-table. Tracked in #25389; the original test bodies
remain recoverable from dcdf9cf.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

…tate

The previous skip condition (!Valid || matches) silently dropped rows
with NULL settings_key_id / api_key_key_id from the rotation loop. That
made the "enable encryption for the first time" path a no-op for any
existing plaintext data, diverging from how user_links, user_secrets,
and chat_providers all handle the same case.

Mirror the chat_providers shape: skip empty/blank values, skip rows
already on the new primary digest, fall through to UpdateEncryptedX
otherwise and let the dbcrypt wrapper encrypt.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>