Fix: ai_provider reads actual DB schema (config_key/config_value rows)

Root cause: ai_provider.py assumed a single JSON blob in an
'encrypted_value' column, but IntegrationConfig stores each credential
as a separate row with config_key + config_value columns.

Fixes:
- Query groups rows by provider, decrypts each config_value separately
- Correct decrypt_value(secret_key, ciphertext) argument order
- Filter by user_id so providers are per-user
- Callers (ai_chat.py, chat()) now pass user_id through

backend/app/routers/ai_chat.py

@@ -54,7 +54,7 @@ async def ai_status(
     db: AsyncSession = Depends(get_db),
 ):
     """Check which AI provider is configured."""
-    provider = await ai_provider.get_active_ai_provider(db)
+    provider = await ai_provider.get_active_ai_provider(db, user_id=user.id)
     if provider:
         return {
             "configured": True,