refactor: separate request auth channel from route kind

Extract request_auth_channel as a distinct routing dimension to distinguish
between api_key and bearer_like authentication methods. This improves routing
clarity by decoupling authentication mechanism from route classification.

apps/aether-gateway/src/ai_serving/finalize/tests_sync.rs

@@ -25,6 +25,7 @@ fn test_decision() -> GatewayControlDecision {
         route_class: Some("ai_public".to_string()),
         route_family: Some("openai".to_string()),
         route_kind: Some("compact".to_string()),
+        request_auth_channel: None,
         auth_endpoint_signature: Some("openai:responses:compact".to_string()),
         execution_runtime_candidate: true,
         auth_context: None,
@@ -1747,6 +1748,7 @@ fn local_finalize_handles_claude_chat_cross_format_sync_response_from_openai_cha
             route_class: Some("ai_public".to_string()),
             route_family: Some("claude".to_string()),
             route_kind: Some("chat".to_string()),
+            request_auth_channel: None,
             auth_endpoint_signature: Some("claude:messages".to_string()),
             execution_runtime_candidate: true,
             auth_context: None,
@@ -1813,6 +1815,7 @@ fn local_finalize_handles_gemini_cli_cross_format_sync_response_from_claude_cli(
             route_class: Some("ai_public".to_string()),
             route_family: Some("gemini".to_string()),
             route_kind: Some("cli".to_string()),
+            request_auth_channel: None,
             auth_endpoint_signature: Some("gemini:generate_content".to_string()),
             execution_runtime_candidate: true,
             auth_context: None,