feat(gateway/data): 新增 usage 关键词搜索、缓存命中摘要、结算成本摘要及 dashboard 聚合查询能力

- 新增 UsageAuditKeywordSearchQuery，支持多关键词、用户名、API Key 交叉过滤
- 新增 UsageCacheHitSummaryQuery/StoredUsageCacheHitSummary，统计请求缓存命中率
- 新增 UsageSettledCostSummaryQuery/StoredUsageSettledCostSummary，汇总结算成本
- 新增 UsageDashboardSummaryQuery、UsageBreakdownSummaryQuery 等 dashboard 聚合类型
- SQL 层实现对应查询方法，含 list_by_ids、list_usage_audits_by_keyword_search、count_usage_audits_by_keyword_search
- 将上述能力通过 GatewayDataState / AdminAppState 暴露给 handler 层
- user_me_usage 及 dashboard_filters 切换为新查询接口，移除旧的内存过滤逻辑
- 同步更新 memory 层及测试

apps/aether-gateway/src/tests/frontdoor/public_support.rs

@@ -4916,6 +4916,114 @@ async fn gateway_handles_users_me_usage_without_legacy_api_key_name_fallback_whe
     upstream_handle.abort();
 }
 
+#[tokio::test]
+async fn gateway_handles_users_me_usage_search_with_model_and_api_key_keywords() {
+    let now = Utc::now();
+    let user = sample_auth_user(now);
+    let access_token = build_test_auth_token(
+        "access",
+        serde_json::Map::from_iter([
+            ("user_id".to_string(), json!(user.id)),
+            ("role".to_string(), json!(user.role)),
+            (
+                "created_at".to_string(),
+                json!(user.created_at.map(|value| value.to_rfc3339())),
+            ),
+            (
+                "session_id".to_string(),
+                json!("session-users-me-usage-multi-keyword-search"),
+            ),
+        ]),
+        now + chrono::Duration::hours(1),
+    );
+    let usage_repository = Arc::new(InMemoryUsageReadRepository::seed(vec![
+        sample_user_usage_audit(
+            "usage-users-me-completed-multi-keyword-search",
+            "req-users-me-completed-multi-keyword-search",
+            "user-auth-1",
+            "gpt-4.1",
+            "OpenAI",
+            "completed",
+            now - chrono::Duration::minutes(20),
+        ),
+        sample_user_usage_audit(
+            "usage-users-me-failed-multi-keyword-search",
+            "req-users-me-failed-multi-keyword-search",
+            "user-auth-1",
+            "claude-3.5-sonnet",
+            "Anthropic",
+            "failed",
+            now - chrono::Duration::minutes(10),
+        ),
+        sample_user_usage_audit(
+            "usage-users-me-streaming-multi-keyword-search",
+            "req-users-me-streaming-multi-keyword-search",
+            "user-auth-1",
+            "gpt-4.1-mini",
+            "OpenAI",
+            "streaming",
+            now - chrono::Duration::minutes(5),
+        ),
+    ]));
+    let auth_repository = Arc::new(InMemoryAuthApiKeySnapshotRepository::seed(vec![(
+        Some("hash-api-key-user-1".to_string()),
+        sample_usage_auth_snapshot("api-key-user-1", "user-auth-1", "renamed-key"),
+    )]));
+    let (gateway_url, upstream_hits, gateway_handle, upstream_handle) =
+        start_auth_gateway_with_builder(|| {
+            let data_state = crate::data::GatewayDataState::with_user_wallet_and_usage_for_tests(
+                Arc::new(InMemoryUserReadRepository::seed_auth_users(vec![
+                    user.clone()
+                ])),
+                Arc::new(InMemoryWalletRepository::seed(vec![sample_auth_wallet(
+                    "user-auth-1",
+                    now,
+                )])),
+                Arc::clone(&usage_repository),
+            )
+            .with_auth_api_key_reader(auth_repository);
+            AppState::new()
+                .expect("gateway should build")
+                .with_data_state_for_tests(data_state)
+                .with_auth_sessions_for_tests([sample_auth_session(
+                    "user-auth-1",
+                    "session-users-me-usage-multi-keyword-search",
+                    "device-users-me-usage-multi-keyword-search",
+                    "refresh-token-users-me-usage-multi-keyword-search",
+                    now,
+                )])
+        })
+        .await;
+
+    let response = reqwest::Client::new()
+        .get(format!(
+            "{gateway_url}/api/users/me/usage?limit=10&offset=0&search=gpt%20renamed-key"
+        ))
+        .header("authorization", format!("Bearer {access_token}"))
+        .header(
+            "x-client-device-id",
+            "device-users-me-usage-multi-keyword-search",
+        )
+        .header("user-agent", "AetherTest/1.0")
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(response.status(), StatusCode::OK);
+    let payload: serde_json::Value = response.json().await.expect("json body should parse");
+    assert_eq!(payload["pagination"]["total"], 2);
+    assert_eq!(
+        payload["records"].as_array().expect("records array").len(),
+        2
+    );
+    assert_eq!(payload["records"][0]["model"], "gpt-4.1-mini");
+    assert_eq!(payload["records"][1]["model"], "gpt-4.1");
+    assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
+
+    gateway_handle.abort();
+    upstream_handle.abort();
+}
+
 #[tokio::test]
 async fn gateway_handles_users_me_usage_active_locally_without_proxying_upstream() {
     let now = Utc::now();