Add secure admin AI provider configuration

apps/api/schema.sql

@@ -292,6 +292,19 @@ CREATE TABLE IF NOT EXISTS ai_provider_configs (
  UNIQUE(organization_id)
 );
 
+-- Tenant-scoped remote AI credentials. Ciphertext is encrypted with the private
+-- key in /data; this table never stores plaintext credentials.
+CREATE TABLE IF NOT EXISTS ai_remote_provider_configs (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ organization_id TEXT NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+ provider TEXT NOT NULL, model TEXT NOT NULL, enabled INTEGER NOT NULL DEFAULT 0,
+ nous_base_url TEXT NOT NULL, firecrawl_base_url TEXT NOT NULL,
+ credentials_ciphertext TEXT NOT NULL DEFAULT '', credentials_fingerprint TEXT NOT NULL DEFAULT '',
+ created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP, updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ UNIQUE(organization_id)
+);
+CREATE INDEX IF NOT EXISTS idx_ai_remote_provider_org ON ai_remote_provider_configs(organization_id);
+
 -- Phase 14 outreach preparation. Provider configuration is metadata plus a
 -- one-way secret fingerprint; outbound transport is intentionally disabled.
 CREATE TABLE IF NOT EXISTS outreach_provider_configs (