Team-level access controls for AI providers

AI providers can now be scoped to specific teams, giving tenant owners more granular control over who can access each provider and its models. This is useful for managing costs, enforcing compliance requirements, or rolling out new models to specific teams first.

The team that owns each provider's credential will always have access. All other teams also have access by default, unless the provider is explicitly scoped.