feat(ai): add the storage for an OpenAI-compatible gateway provider

Three dedicated User columns — base URL, optional bearer, model — for a
provider whose endpoint the user chooses. They are separate from the
OpenAI columns on purpose: the OpenAI arm pins api.openai.com, so it must
share no column with a user-supplied host, and a gateway must never
receive the key issued for OpenAI.

The bearer joins the encrypted-column registry and the rotation script;
the three columns join the account-wipe reset set.

scripts/rotate-encryption-key.ts

@@ -170,7 +170,8 @@ async function main() {
   // "ouraClientSecretEncrypted" "stravaClientIdEncrypted"
   // "stravaClientSecretEncrypted" "stravaAccessTokenEncrypted"
   // "stravaRefreshTokenEncrypted" "aiAnthropicKeyEncrypted"
-  // "aiLocalKeyEncrypted" "aiOpenaiKeyEncrypted" "insuranceNumberEncrypted"
+  // "aiLocalKeyEncrypted" "aiOpenaiKeyEncrypted" "aiCompatKeyEncrypted"
+  // "insuranceNumberEncrypted"
   const userFields = [
     "codexAccessTokenEncrypted",
     "codexRefreshTokenEncrypted",
@@ -200,6 +201,8 @@ async function main() {
     "aiAnthropicKeyEncrypted",
     "aiLocalKeyEncrypted",
     "aiOpenaiKeyEncrypted",
+    // v1.33.1 (#470) — the OpenAI-compatible gateway's optional bearer.
+    "aiCompatKeyEncrypted",
     "insuranceNumberEncrypted",
     // v1.23 — TOTP shared secret (second factor).
     "totpSecretEncrypted",