refactor: 移除 Python 后端源码，全面迁移至 Rust gateway 架构

- 删除全部 Python 源码 (src/) 及 Alembic 迁移脚本，归档至 _deprecated_py_src/
- 重构 Rust gateway ai_pipeline: 拆分 planner/finalize 模块，新增 contracts/adaptation 层
- 重组 handlers 模块为 admin/public/proxy/internal/shared 子模块结构
- 新增 executor 模块，引入 Rust 原生数据库迁移 (aether-data/migrations)
- 简化 CI/Docker 构建流程，移除 base image 二级构建，统一为单一 app image
- 移除 Python 相关基础设施文件 (entrypoint.sh, gunicorn_conf.py, Dockerfile.base)

apps/aether-gateway/src/middleware/strip_cf_headers.rs

@@ -0,0 +1,36 @@
+use axum::{extract::Request, middleware::Next, response::Response};
+use http::header::HeaderName;
+
+/// Cloudflare headers to strip from incoming requests and outgoing responses.
+/// Prevents leaking CF metadata to upstream providers or back to clients.
+static CF_HEADERS: &[&str] = &[
+    "cf-connecting-ip",
+    "cf-ipcountry",
+    "cf-ray",
+    "cf-visitor",
+    "cdn-loop",
+    "true-client-ip",
+    "cf-worker",
+    "cf-ew-via",
+    "cf-warp-tag-id",
+];
+
+pub(crate) async fn strip_cf_headers_middleware(mut request: Request, next: Next) -> Response {
+    // Strip CF headers from the incoming request
+    for name in CF_HEADERS {
+        if let Ok(header) = HeaderName::from_bytes(name.as_bytes()) {
+            request.headers_mut().remove(&header);
+        }
+    }
+
+    let mut response = next.run(request).await;
+
+    // Strip CF headers from the outgoing response
+    for name in CF_HEADERS {
+        if let Ok(header) = HeaderName::from_bytes(name.as_bytes()) {
+            response.headers_mut().remove(&header);
+        }
+    }
+
+    response
+}