Disclaimer: implemented by a Coder Agent using Claude Opus 4.7

Part of the implementation of RFC: Common AI Provider Configs (AIGOV-201).

What this PR does

Switches the in-memory aibridged daemon from a static, env-derived provider list to a database-backed list that hot-reloads via pubsub. After this PR:

• aibridged loads providers from ai_providers at startup (system actor, dbauthz-gated).
• The AI provider CRUD handlers publish on ai_providers_changed after every successful Insert/Update/SoftDelete on a provider or key.
• Each replica subscribes to that channel and triggers aibridged.Server.Reload, which atomically swaps the providers slice on the pool and clears the cached RequestBridge instances.
• In-flight requests continue against their existing RequestBridge until completion; the cache's OnEvict shutdown closes MCP connections in the background after the existing 5-second grace period.

The proxy daemon is intentionally NOT reloaded yet to keep this PR focused; it still receives the boot-time provider snapshot. A follow-up will introduce a Pooler interface for the proxy and mirror this pattern.

Pubsub channel

The channel name (ai_providers_changed, exported as coderd.AIProvidersChangedChannel) is provider-generic, not aibridge-specific: any future consumer of ai_providers rows can subscribe. Today aibridged is the only subscriber.

Pool changes

• CachedBridgePool stores providers via atomic.Pointer[[]Provider] instead of a fixed slice.
• New Reload(providers) method on the Pooler interface that atomically swaps the snapshot, calls cache.Clear, and cache.Waits for buffered writes to drain so a subsequent Acquire always sees the cleared state.

Wire-up

• enterprise/cli/server.go now calls loadProvidersFromDB(ctx, db, cfg) instead of buildProviders(cfg). The legacy env-driven buildProviders is preserved for the proxy daemon path until the proxy reload follow-up lands.
• After the daemon is started, the CLI subscribes to coderd.AIProvidersChangedChannel. Each notification re-loads providers from the database and calls aibridgeDaemon.Reload(...).

Tests

• TestPoolReload — prime the cache, Reload, observe that the next Acquire is a fresh build (KeysAdded=1, Misses=1 against the post-Reload zeroed metrics).
• TestPoolReloadAfterShutdown — Reload is a safe no-op after Shutdown.
• TestAIProvidersPubsubPublish / TestAIProviderKeysPubsubPublish — end-to-end: each handler mutation publishes a notification on the providers-changed channel.
• All existing CRUD tests (TestAIProvidersCRUD, TestAIProviderKeysCRUD) still pass with the new publish hook in the handlers.