perf(ai-gateway): read routing credentials from replicas

[chrarnoldus]

Summary

• use readDb for direct and Vercel BYOK credential lookup during AI gateway provider resolution
• use readDb for custom LLM provider lookup
• use readDb for request-time Organization Auto BYOK validation while preserving explicitly supplied primary transactions for admin mutations
• assert that embedding BYOK resolution receives the readonly client

Consistency

These request-time reads may briefly observe stale credential or configuration state during replica lag. Write paths and transaction-scoped Organization Auto validation remain on the primary.

Validation

• pnpm exec oxfmt --list-different apps/web/src/lib/ai-gateway/providers/get-provider.ts apps/web/src/lib/ai-gateway/providers/getEmbeddingProvider.test.ts apps/web/src/lib/organizations/organization-auto-model.ts
• pnpm exec oxlint --config .oxlintrc.json apps/web/src/lib/ai-gateway/providers/get-provider.ts apps/web/src/lib/ai-gateway/providers/getEmbeddingProvider.test.ts apps/web/src/lib/organizations/organization-auto-model.ts
• pnpm --filter web test --runInBand --runTestsByPath src/lib/ai-gateway/providers/getEmbeddingProvider.test.ts src/routers/organizations/organization-settings-router.test.ts src/routers/organizations/organization-modes-router.test.ts
• pnpm --filter web typecheck
• git diff --check

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Mechanical swap of primary db reads to readDb for AI-gateway provider/BYOK routing lookups, correctly preserving explicit transaction/dbClient overrides on write paths, with no issues found.

Files Reviewed (3 files)

• apps/web/src/lib/ai-gateway/providers/get-provider.ts
• apps/web/src/lib/ai-gateway/providers/getEmbeddingProvider.test.ts
• apps/web/src/lib/organizations/organization-auto-model.ts

---

_{Reviewed by claude-sonnet-5 · Input: 16 · Output: 3.2K · Cached: 325.8K}

_{Review guidance: REVIEW.md from base branch main}