feat(permissions): add AI module to enterprise custom roles

[imrja8]

What is this PR about?

This PR adds AI access controls to Enterprise Custom Roles, resolving issue #5487 .

What this PR does

• Granular Permissions: Adds the ai module to the Custom Roles settings, allowing admins to selectively grant users access to Read, Create, Update, or Delete AI configurations.
• Secure Backend: Enforces these new permissions across all standard AI API endpoints to ensure strict security.
• Dynamic UI: Updates the sidebar and AI Settings page to conditionally show the AI tab and action buttons based on the user's specific custom permissions.

Security Model: Write-Only API Key Masking

To prevent AI API keys from leaking, this PR implements a strict "write-only" security model, identical to how major platforms handle sensitive inputs (e.g., GitHub Actions Secrets, Cloudflare Workers):

• Permanent Masking: Once an API key is saved, the raw key is never revealed to the frontend again. The backend swaps it with a placeholder (********), guaranteeing the real key cannot be stolen via the browser's Network tab. In the UI fields, users will only ever see this ******** placeholder.
• Strict Updates: Any alteration to the masked string upon form submission is intentionally treated as a deliberate attempt to update the key. However, if the API key field is left untouched, authorized user or admin can change other options (like the model or URL) and it will work seamlessly without breaking the existing key.
• Authorized Control: Because the update form is strictly locked behind the update permission, no random user can accidentally alter or break the key. If an authorized user or admin chooses to overwrite it, it is safely assumed they have the authority to retrieve a new key from their provider or have the old one safely stored. This perfectly mirrors GitHub Repository Secrets (where editing an existing secret shows a blank box that must be overwritten) and Cloudflare Worker Secrets (where secrets become [hidden] forever).

What was skipped intentionally

(Note: These items were intentionally omitted to maintain scope strictly on Enterprise Custom Roles)

1. Default Member Role: AI features remain inaccessible for the base member role. This area was skipped as this PR is strictly targeted at unlocking permissions for Enterprise Custom Roles.
2. Project UI Buttons: The visibility of the AI Assistant or "Analyze Logs" buttons in the project/environment UI was not modified. While currently visible but unusable for standard members without read permissions, isolating that specific UI leak will be handled cleanly in a separate PR.

(Note: The ability to manage organization-wide "Custom AI Presets" introduced in PR #4882 remains strictly locked to Organization Admins and cannot be delegated to custom roles.)

Checklist

Before submitting this PR, please make sure that:

• A dedicated branch based on the canary branch has been created.
• The suggestions in the CONTRIBUTING.md file https://github.com/Dokploy/dokploy/blob/canary/CONTRIBUTING.md#pull-request have been read.
• This PR has been tested in a local instance. If it has not been tested yet, please do so before submitting. This helps avoid wasting maintainers' time reviewing code that has not been verified.

Issues related (if applicable)

closes #5487

Screenshots (if applicable)

Confidence Score: 5/5

The PR appears safe to merge; no outstanding authorization, tenant-isolation, credential-exposure, or other actionable regression was established.

Summary

This PR adds AI as an enterprise custom-role resource and applies granular AI permissions throughout the settings UI and API.

• Adds read, create, update, and delete grants to access-control definitions and the custom-role editor.
• Gates AI navigation, configuration actions, model discovery, connection testing, and AI features by the relevant permission.
• Scopes configuration operations to the active organization and protects stored API keys through omission, masking, and authorized server-side resolution.
• Adds audit logging for AI configuration mutations.

_{Reviews (6) · Last reviewed commit: "perf(ai): optimize permission evaluation..."}

[imrja8]

@narcisonunez

This PR is ready for review, Please check it.