fix: use bare secret key for botAppSecretRef, not ${secrets.} wrapper

The bridge expects a bare key (e.g. TEAMS_BOT_SECRET) that it
resolves directly from the secret store. The ${secrets.} template
pattern is for interpolation in deployment env vars, not for ref
fields read by external services.

Removes extractSecretName regex and SECRET_TEMPLATE_REGEX. Proto
validation updated to accept bare UPPER_SNAKE_CASE keys.

Author: birdayz

frontend/src/components/pages/agents/details/ai-agent-integrations-tab.tsx

@@ -35,8 +35,6 @@ import { formatToastErrorMessageGRPC } from 'utils/toast.utils';
 
 const routeApi = getRouteApi('/agents/$id/');
 
-const SECRET_TEMPLATE_REGEX = /^\$\{secrets\.([^}]+)\}$/;
-
 const TEAMS_SECRET_TEXT = {
   dialogDescription: 'Create a new secret for your Microsoft Teams bot client secret.',
   secretNamePlaceholder: 'e.g., TEAMS_CLIENT_SECRET',
@@ -52,11 +50,6 @@ type TeamsBridgeState = {
   botAppSecretName: string;
 };
 
-const extractSecretName = (ref: string): string => {
-  const match = ref.match(SECRET_TEMPLATE_REGEX);
-  return match ? match[1] : '';
-};
-
 // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: Integrations tab with edit/view mode conditionals
 export const AIAgentIntegrationsTab = () => {
   const { id } = routeApi.useParams();
@@ -86,7 +79,7 @@ export const AIAgentIntegrationsTab = () => {
     enabled: agent.teamsBridge?.enabled ?? false,
     botAppId: agent.teamsBridge?.botAppId ?? '',
     botTenantId: agent.teamsBridge?.botTenantId ?? '',
-    botAppSecretName: extractSecretName(agent.teamsBridge?.botAppSecretRef ?? ''),
+    botAppSecretName: agent.teamsBridge?.botAppSecretRef ?? '',
   };
 
   const updateField = (updates: Partial<TeamsBridgeState>) => {
@@ -98,7 +91,7 @@ export const AIAgentIntegrationsTab = () => {
       return;
     }
 
-    const secretRef = displayState.botAppSecretName ? `\${secrets.${displayState.botAppSecretName}}` : '';
+    const secretRef = displayState.botAppSecretName || '';
 
     try {
       await updateAIAgent(

proto/redpanda/api/dataplane/v1alpha3/ai_agent.proto

@@ -309,7 +309,7 @@ message AIAgentTeamsBridge {
   string bot_tenant_id = 3;
   string bot_app_secret_ref = 4 [
     (buf.validate.field).ignore = IGNORE_IF_ZERO_VALUE,
-    (buf.validate.field).string.pattern = "^\\$\\{secrets\\.[A-Za-z_][A-Za-z0-9_]*(\\.[A-Za-z_][A-Za-z0-9_]*)?\\}$"
+    (buf.validate.field).string.pattern = "^[A-Za-z_][A-Za-z0-9_]*$"
   ];
 }