refactor: 移除 Python 后端源码，全面迁移至 Rust gateway 架构

- 删除全部 Python 源码 (src/) 及 Alembic 迁移脚本，归档至 _deprecated_py_src/
- 重构 Rust gateway ai_pipeline: 拆分 planner/finalize 模块，新增 contracts/adaptation 层
- 重组 handlers 模块为 admin/public/proxy/internal/shared 子模块结构
- 新增 executor 模块，引入 Rust 原生数据库迁移 (aether-data/migrations)
- 简化 CI/Docker 构建流程，移除 base image 二级构建，统一为单一 app image
- 移除 Python 相关基础设施文件 (entrypoint.sh, gunicorn_conf.py, Dockerfile.base)

_deprecated_py_src/services/auth/oauth/state.py

@@ -0,0 +1,145 @@
+from __future__ import annotations
+
+import json
+import secrets
+import time
+from collections.abc import Awaitable
+from dataclasses import dataclass
+from typing import Any, cast
+
+from redis.asyncio import Redis
+
+OAUTH_STATE_TTL_SECONDS = 600
+OAUTH_STATE_KEY_PREFIX = "oauth_state:"
+
+# OAuth bind token: 用于安全地在浏览器跳转时传递用户身份
+# 短期有效（5分钟），一次性使用
+OAUTH_BIND_TOKEN_TTL_SECONDS = 300
+OAUTH_BIND_TOKEN_KEY_PREFIX = "oauth_bind_token:"
+
+
+CONSUME_STATE_SCRIPT = r"""
+local value = redis.call("GET", KEYS[1])
+if value then
+    redis.call("DEL", KEYS[1])
+end
+return value
+"""
+
+
+@dataclass(frozen=True)
+class OAuthStateData:
+    nonce: str
+    provider_type: str
+    action: str  # "login" | "bind"
+    user_id: str | None
+    client_device_id: str | None
+    created_at: int
+
+    @classmethod
+    def from_dict(cls, data: dict[str, Any]) -> OAuthStateData:
+        return cls(
+            nonce=str(data.get("nonce") or ""),
+            provider_type=str(data.get("provider_type") or ""),
+            action=str(data.get("action") or ""),
+            user_id=data.get("user_id"),
+            client_device_id=data.get("client_device_id"),
+            created_at=int(data.get("created_at") or 0),
+        )
+
+
+def _state_key(nonce: str) -> str:
+    return f"{OAUTH_STATE_KEY_PREFIX}{nonce}"
+
+
+async def create_oauth_state(
+    redis: Redis,
+    *,
+    provider_type: str,
+    action: str,
+    user_id: str | None = None,
+    client_device_id: str | None = None,
+) -> str:
+    nonce = secrets.token_urlsafe(24)
+    data = {
+        "nonce": nonce,
+        "provider_type": provider_type,
+        "action": action,
+        "user_id": user_id,
+        "client_device_id": client_device_id,
+        "created_at": int(time.time()),
+    }
+    await redis.setex(_state_key(nonce), OAUTH_STATE_TTL_SECONDS, json.dumps(data))
+    return nonce
+
+
+async def consume_oauth_state(redis: Redis, nonce: str) -> OAuthStateData | None:
+    if not nonce:
+        return None
+
+    key = _state_key(nonce)
+    # redis-py 的类型标注在 sync/async 之间会出现 Union；这里明确按 async 处理。
+    raw = await cast(Awaitable[str | None], redis.eval(CONSUME_STATE_SCRIPT, 1, key))
+    if not raw:
+        return None
+
+    try:
+        parsed = json.loads(raw)
+    except json.JSONDecodeError:
+        return None
+
+    return OAuthStateData.from_dict(parsed)
+
+
+@dataclass(frozen=True)
+class OAuthBindTokenData:
+    """OAuth 绑定临时令牌数据，用于浏览器跳转场景的安全认证"""
+
+    token: str
+    user_id: str
+    provider_type: str
+    created_at: int
+
+    @classmethod
+    def from_dict(cls, data: dict[str, Any]) -> OAuthBindTokenData:
+        return cls(
+            token=str(data.get("token") or ""),
+            user_id=str(data.get("user_id") or ""),
+            provider_type=str(data.get("provider_type") or ""),
+            created_at=int(data.get("created_at") or 0),
+        )
+
+
+def _bind_token_key(token: str) -> str:
+    return f"{OAUTH_BIND_TOKEN_KEY_PREFIX}{token}"
+
+
+async def create_oauth_bind_token(redis: Redis, *, user_id: str, provider_type: str) -> str:
+    """创建一次性 OAuth 绑定令牌，用于浏览器跳转场景"""
+    token = secrets.token_urlsafe(32)
+    data = {
+        "token": token,
+        "user_id": user_id,
+        "provider_type": provider_type,
+        "created_at": int(time.time()),
+    }
+    await redis.setex(_bind_token_key(token), OAUTH_BIND_TOKEN_TTL_SECONDS, json.dumps(data))
+    return token
+
+
+async def consume_oauth_bind_token(redis: Redis, token: str) -> OAuthBindTokenData | None:
+    """消费（验证并删除）OAuth 绑定令牌，返回令牌数据或 None"""
+    if not token:
+        return None
+
+    key = _bind_token_key(token)
+    raw = await cast(Awaitable[str | None], redis.eval(CONSUME_STATE_SCRIPT, 1, key))
+    if not raw:
+        return None
+
+    try:
+        parsed = json.loads(raw)
+    except json.JSONDecodeError:
+        return None
+
+    return OAuthBindTokenData.from_dict(parsed)