refactor: 拆分 system.rs 大文件，将 email_templates/proxy_errors/system_config 下沉到 shared 层

- 删除 1666 行的 admin/system/shared/system.rs，按职责拆分到独立模块
- 新增 handlers/shared/email_templates.rs 和 system_config_values.rs 存放跨层共用的模板/配置工具函数
- 新增 admin/system/shared/email_templates.rs 存放 admin 专用的模板操作逻辑
- 新增 admin/shared/proxy_errors.rs 存放 build_proxy_error_response
- 清理 public/system_modules_helpers 中不属于 public 层的导出
- 新增架构测试守护模块归属边界

apps/aether-gateway/src/handlers/admin/auth/mod.rs

@@ -8,7 +8,7 @@ pub(crate) use self::api_keys::maybe_build_local_admin_api_keys_response;
 pub(crate) use self::ldap::maybe_build_local_admin_ldap_response;
 pub(crate) use self::oauth_config::{
     build_admin_oauth_provider_payload, build_admin_oauth_supported_types_payload,
-    build_admin_oauth_upsert_record, build_proxy_error_response,
+    build_admin_oauth_upsert_record,
 };
 pub(crate) use self::oauth_routes::maybe_build_local_admin_oauth_response;
 pub(crate) use self::security::maybe_build_local_admin_security_response;

apps/aether-gateway/src/handlers/admin/auth/oauth_config.rs

@@ -3,12 +3,7 @@ use crate::AppState;
 use aether_data::repository::oauth_providers::{
     EncryptedSecretUpdate, UpsertOAuthProviderConfigRecord,
 };
-use axum::{
-    body::Body,
-    http,
-    response::{IntoResponse, Response},
-    Json,
-};
+use axum::http;
 use serde::Deserialize;
 use serde_json::json;
 use url::Url;
@@ -70,26 +65,6 @@ pub(crate) fn build_admin_oauth_provider_payload(
     })
 }
 
-pub(crate) fn build_proxy_error_response(
-    status: http::StatusCode,
-    error_type: &str,
-    message: impl Into<String>,
-    details: Option<serde_json::Value>,
-) -> Response<Body> {
-    let message = message.into();
-    let mut error = serde_json::Map::new();
-    error.insert("type".to_string(), json!(error_type));
-    error.insert("message".to_string(), json!(message));
-    if let Some(details) = details {
-        error.insert("details".to_string(), details);
-    }
-    (
-        status,
-        Json(json!({ "error": serde_json::Value::Object(error) })),
-    )
-        .into_response()
-}
-
 pub(crate) fn admin_oauth_provider_type_from_path(request_path: &str) -> Option<String> {
     let provider_type = request_path.strip_prefix("/api/admin/oauth/providers/")?;
     (!provider_type.is_empty() && !provider_type.contains('/')).then_some(provider_type.to_string())

apps/aether-gateway/src/handlers/admin/auth/oauth_routes.rs

@@ -1,10 +1,10 @@
 use super::oauth_config::{
     admin_oauth_provider_type_from_path, admin_oauth_test_provider_type_from_path,
     build_admin_oauth_provider_payload, build_admin_oauth_supported_types_payload,
-    build_admin_oauth_upsert_record, build_proxy_error_response, AdminOAuthProviderUpsertRequest,
+    build_admin_oauth_upsert_record, AdminOAuthProviderUpsertRequest,
 };
 use crate::control::GatewayPublicRequestContext;
-use crate::handlers::admin::shared::attach_admin_audit_response;
+use crate::handlers::admin::shared::{attach_admin_audit_response, build_proxy_error_response};
 use crate::{AppState, GatewayError};
 use axum::{
     body::{Body, Bytes},