refactor: separate request auth channel from route kind

Extract request_auth_channel as a distinct routing dimension to distinguish
between api_key and bearer_like authentication methods. This improves routing
clarity by decoupling authentication mechanism from route classification.

apps/aether-gateway/src/ai_serving/api.rs

@@ -66,6 +66,7 @@ pub(crate) fn resolve_execution_runtime_stream_plan_kind(
         decision.route_class.as_deref(),
         decision.route_family.as_deref(),
         decision.route_kind.as_deref(),
+        decision.request_auth_channel.as_deref(),
         &parts.method,
         parts.uri.path(),
     )
@@ -79,6 +80,7 @@ pub(crate) fn resolve_execution_runtime_sync_plan_kind(
         decision.route_class.as_deref(),
         decision.route_family.as_deref(),
         decision.route_kind.as_deref(),
+        decision.request_auth_channel.as_deref(),
         &parts.method,
         parts.uri.path(),
     )

apps/aether-gateway/src/ai_serving/finalize/tests_sync.rs

@@ -25,6 +25,7 @@ fn test_decision() -> GatewayControlDecision {
         route_class: Some("ai_public".to_string()),
         route_family: Some("openai".to_string()),
         route_kind: Some("compact".to_string()),
+        request_auth_channel: None,
         auth_endpoint_signature: Some("openai:responses:compact".to_string()),
         execution_runtime_candidate: true,
         auth_context: None,
@@ -1747,6 +1748,7 @@ fn local_finalize_handles_claude_chat_cross_format_sync_response_from_openai_cha
             route_class: Some("ai_public".to_string()),
             route_family: Some("claude".to_string()),
             route_kind: Some("chat".to_string()),
+            request_auth_channel: None,
             auth_endpoint_signature: Some("claude:messages".to_string()),
             execution_runtime_candidate: true,
             auth_context: None,
@@ -1813,6 +1815,7 @@ fn local_finalize_handles_gemini_cli_cross_format_sync_response_from_claude_cli(
             route_class: Some("ai_public".to_string()),
             route_family: Some("gemini".to_string()),
             route_kind: Some("cli".to_string()),
+            request_auth_channel: None,
             auth_endpoint_signature: Some("gemini:generate_content".to_string()),
             execution_runtime_candidate: true,
             auth_context: None,

apps/aether-gateway/src/ai_serving/planner/route.rs

@@ -15,6 +15,7 @@ pub(crate) fn resolve_execution_runtime_stream_plan_kind(
         decision.route_class.as_deref(),
         decision.route_family.as_deref(),
         decision.route_kind.as_deref(),
+        decision.request_auth_channel.as_deref(),
         &parts.method,
         parts.uri.path(),
     )
@@ -28,6 +29,7 @@ pub(crate) fn resolve_execution_runtime_sync_plan_kind(
         decision.route_class.as_deref(),
         decision.route_family.as_deref(),
         decision.route_kind.as_deref(),
+        decision.request_auth_channel.as_deref(),
         &parts.method,
         parts.uri.path(),
     )
@@ -69,6 +71,7 @@ mod tests {
             route_class: Some("ai_public".to_string()),
             route_family: Some(route_family.to_string()),
             route_kind: Some(route_kind.to_string()),
+            request_auth_channel: None,
             auth_context: None,
             admin_principal: None,
             auth_endpoint_signature: None,
@@ -77,6 +80,16 @@ mod tests {
         }
     }
 
+    fn sample_decision_with_auth_channel(
+        route_family: &str,
+        route_kind: &str,
+        request_auth_channel: &str,
+    ) -> GatewayControlDecision {
+        let mut decision = sample_decision(route_family, route_kind);
+        decision.request_auth_channel = Some(request_auth_channel.to_string());
+        decision
+    }
+
     #[test]
     fn resolves_openai_chat_plan_kinds_via_format_crate() {
         let request = Request::builder()
@@ -97,6 +110,47 @@ mod tests {
         );
     }
 
+    #[test]
+    fn resolves_endpoint_route_kinds_by_request_auth_channel_via_format_crate() {
+        let claude_request = Request::builder()
+            .method(Method::POST)
+            .uri("/v1/messages")
+            .body(())
+            .expect("request should build");
+        let (claude_parts, _) = claude_request.into_parts();
+
+        let claude_api_key = sample_decision_with_auth_channel("claude", "messages", "api_key");
+        let claude_bearer = sample_decision_with_auth_channel("claude", "messages", "bearer_like");
+        assert_eq!(
+            resolve_execution_runtime_sync_plan_kind(&claude_parts, &claude_api_key),
+            Some("claude_chat_sync")
+        );
+        assert_eq!(
+            resolve_execution_runtime_stream_plan_kind(&claude_parts, &claude_bearer),
+            Some("claude_cli_stream")
+        );
+
+        let gemini_request = Request::builder()
+            .method(Method::POST)
+            .uri("/v1beta/models/gemini-2.5-pro:generateContent")
+            .body(())
+            .expect("request should build");
+        let (gemini_parts, _) = gemini_request.into_parts();
+
+        let gemini_api_key =
+            sample_decision_with_auth_channel("gemini", "generate_content", "api_key");
+        let gemini_bearer =
+            sample_decision_with_auth_channel("gemini", "generate_content", "bearer_like");
+        assert_eq!(
+            resolve_execution_runtime_sync_plan_kind(&gemini_parts, &gemini_api_key),
+            Some("gemini_chat_sync")
+        );
+        assert_eq!(
+            resolve_execution_runtime_sync_plan_kind(&gemini_parts, &gemini_bearer),
+            Some("gemini_cli_sync")
+        );
+    }
+
     #[test]
     fn stream_matching_uses_surface_route_logic() {
         let request = Request::builder()