…eys API

Adds a deprecation banner under the 'Configure Providers' section
explaining that environment-driven provider configuration is now
reconciled into the database-backed ai_providers table at startup and
that the recommended way to manage providers going forward is the
/api/v2/aibridge/providers HTTP API.

Documents the new providers/keys split:

  - POST /api/v2/aibridge/providers no longer carries an api_key
    field; provider rows are now created first, and keys are
    attached via POST /api/v2/aibridge/providers/{name}/keys.
  - The keys sub-resource (GET/POST/DELETE) is the canonical place
    to manage bearer tokens, with multi-key failover (oldest key
    wins, future versions will rotate on 401/quota errors) and
    rotation semantics (add new, then delete old).
  - Bedrock-routed Anthropic providers have zero keys; their AWS
    credentials live in the encrypted settings.bedrock_access_key
    and settings.bedrock_access_key_secret because Bedrock
    authenticates via SigV4 rather than a bearer token. POST keys
    against a Bedrock provider returns 400.
  - Key add and delete also publish on ai_providers_changed so the
    runtime pool reloads.

Marks the indexed CODER_AIBRIDGE_PROVIDER_<N>_* form as deprecated in
its own subsection heading and points readers at the API.