refactor: 拆分 admin handler 大文件为模块目录，消除 shared.rs 反模式

- endpoint_keys/pool/architecture 等大文件拆分为独立模块目录
- 删除 crud/query/strategy/system 中的 shared.rs，内容归位到各自模块
- endpoints_admin/models/oauth/write 等模块拆出 payloads/responses/support 子文件
- system/core 下多个 *_routes.rs 合并到 system_routes.rs
- 更新 refactor-execution-plan 文档进度

apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/batch.rs

@@ -1,20 +1,20 @@
-use super::super::provider_oauth_refresh::{
+use super::super::refresh::{
     build_internal_control_error_response, build_provider_oauth_auth_config_from_token_payload,
     create_provider_oauth_catalog_key, find_duplicate_provider_oauth_key,
     provider_oauth_active_api_formats, provider_oauth_key_proxy_value,
     refresh_provider_oauth_account_state_after_update, update_existing_provider_oauth_catalog_key,
 };
-use super::super::provider_oauth_state::{
+use super::super::state::{
     admin_provider_oauth_template, build_admin_provider_oauth_backend_unavailable_response,
     current_unix_secs, decode_jwt_claims, exchange_admin_provider_oauth_refresh_token,
     is_fixed_provider_type_for_provider_oauth, save_provider_oauth_batch_task_payload,
 };
 use crate::control::GatewayPublicRequestContext;
-use crate::handlers::admin::provider::shared::{
+use crate::handlers::admin::provider::shared::paths::{
     admin_provider_oauth_batch_import_provider_id,
     admin_provider_oauth_batch_import_task_provider_id,
-    ADMIN_PROVIDER_OAUTH_DATA_UNAVAILABLE_DETAIL,
 };
+use crate::handlers::admin::provider::shared::support::ADMIN_PROVIDER_OAUTH_DATA_UNAVAILABLE_DETAIL;
 use crate::{AppState, GatewayError};
 use axum::{
     body::{to_bytes, Body, Bytes},

apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/complete.rs

@@ -1,18 +1,18 @@
-use super::super::provider_oauth_quota::refresh_codex_provider_quota_locally;
-use super::super::provider_oauth_refresh::{
+use super::super::quota::codex::refresh_codex_provider_quota_locally;
+use super::super::refresh::{
     build_internal_control_error_response, build_provider_oauth_auth_config_from_token_payload,
     create_provider_oauth_catalog_key, find_duplicate_provider_oauth_key,
     provider_oauth_active_api_formats, provider_oauth_key_proxy_value,
     refresh_provider_oauth_account_state_after_update, update_existing_provider_oauth_catalog_key,
 };
-use super::super::provider_oauth_state::{
+use super::super::state::{
     admin_provider_oauth_template, build_admin_provider_oauth_backend_unavailable_response,
     consume_provider_oauth_state, enrich_admin_provider_oauth_auth_config,
     exchange_admin_provider_oauth_code, is_fixed_provider_type_for_provider_oauth,
     json_non_empty_string, json_u64_value, parse_provider_oauth_callback_params,
 };
 use crate::control::GatewayPublicRequestContext;
-use crate::handlers::admin::provider::shared::{
+use crate::handlers::admin::provider::shared::paths::{
     admin_provider_oauth_complete_key_id, admin_provider_oauth_complete_provider_id,
 };
 use crate::handlers::admin::shared::encrypt_catalog_secret_with_fallbacks;

apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/device.rs

@@ -1,10 +1,10 @@
-use super::super::provider_oauth_refresh::{
+use super::super::refresh::{
     build_internal_control_error_response, build_provider_oauth_auth_config_from_token_payload,
     create_provider_oauth_catalog_key, find_duplicate_provider_oauth_key,
     provider_oauth_active_api_formats, provider_oauth_key_proxy_value,
     refresh_provider_oauth_account_state_after_update, update_existing_provider_oauth_catalog_key,
 };
-use super::super::provider_oauth_state::{
+use super::super::state::{
     build_admin_provider_oauth_backend_unavailable_response, build_kiro_device_key_name,
     current_unix_secs, decode_jwt_claims, default_kiro_device_region,
     default_kiro_device_start_url, generate_provider_oauth_nonce, json_non_empty_string,
@@ -13,7 +13,7 @@ use super::super::provider_oauth_state::{
     save_provider_oauth_device_session, start_admin_kiro_device_authorization,
 };
 use crate::control::GatewayPublicRequestContext;
-use crate::handlers::admin::provider::shared::{
+use crate::handlers::admin::provider::shared::paths::{
     admin_provider_oauth_device_authorize_provider_id, admin_provider_oauth_device_poll_provider_id,
 };
 use crate::handlers::admin::shared::attach_admin_audit_response;

apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/helpers.rs

@@ -0,0 +1,21 @@
+use crate::handlers::admin::shared::attach_admin_audit_response;
+use axum::{
+    body::Body,
+    response::{IntoResponse, Response},
+};
+
+pub(super) fn attach_admin_provider_oauth_audit_response(
+    response: Response<Body>,
+    event_name: &'static str,
+    action: &'static str,
+    target_type: &'static str,
+    target_id: Option<String>,
+) -> Response<Body> {
+    if !response.status().is_success() {
+        return response;
+    }
+    let Some(target_id) = target_id else {
+        return response;
+    };
+    attach_admin_audit_response(response, event_name, action, target_type, &target_id)
+}

apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/import.rs

@@ -1,15 +1,15 @@
-use super::super::provider_oauth_refresh::{
+use super::super::refresh::{
     build_internal_control_error_response, build_provider_oauth_auth_config_from_token_payload,
     create_provider_oauth_catalog_key, find_duplicate_provider_oauth_key,
     provider_oauth_active_api_formats, provider_oauth_key_proxy_value,
     refresh_provider_oauth_account_state_after_update, update_existing_provider_oauth_catalog_key,
 };
-use super::super::provider_oauth_state::{
+use super::super::state::{
     admin_provider_oauth_template, build_admin_provider_oauth_backend_unavailable_response,
     exchange_admin_provider_oauth_refresh_token, is_fixed_provider_type_for_provider_oauth,
 };
 use crate::control::GatewayPublicRequestContext;
-use crate::handlers::admin::provider::shared::admin_provider_oauth_import_provider_id;
+use crate::handlers::admin::provider::shared::paths::admin_provider_oauth_import_provider_id;
 use crate::{AppState, GatewayError};
 use axum::{
     body::Body,

apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/mod.rs

@@ -1,16 +1,15 @@
-use super::provider_oauth_state::{
+use super::state::{
     build_admin_provider_oauth_backend_unavailable_response,
     build_admin_provider_oauth_supported_types_payload,
 };
 use crate::control::GatewayPublicRequestContext;
-use crate::handlers::admin::provider::shared::{
+use crate::handlers::admin::provider::shared::paths::{
     admin_provider_oauth_batch_import_provider_id,
     admin_provider_oauth_batch_import_task_provider_id, admin_provider_oauth_complete_key_id,
     admin_provider_oauth_complete_provider_id, admin_provider_oauth_device_authorize_provider_id,
     admin_provider_oauth_import_provider_id, admin_provider_oauth_refresh_key_id,
     admin_provider_oauth_start_key_id, admin_provider_oauth_start_provider_id,
 };
-use crate::handlers::admin::shared::attach_admin_audit_response;
 use crate::{AppState, GatewayError};
 use axum::{
     body::{Body, Bytes},
@@ -22,6 +21,7 @@ use axum::{
 mod batch;
 mod complete;
 mod device;
+mod helpers;
 mod import;
 mod refresh;
 mod start;
@@ -53,7 +53,7 @@ pub(crate) async fn maybe_build_local_admin_provider_oauth_response(
 
     if route_kind == Some("start_key_oauth") && *method == http::Method::POST {
         let response = start::handle_admin_provider_oauth_start_key(state, request_context).await?;
-        return Ok(Some(attach_admin_provider_oauth_audit_response(
+        return Ok(Some(helpers::attach_admin_provider_oauth_audit_response(
             response,
             "admin_provider_oauth_authorization_started",
             "start_provider_oauth_for_key",
@@ -65,7 +65,7 @@ pub(crate) async fn maybe_build_local_admin_provider_oauth_response(
     if route_kind == Some("start_provider_oauth") && *method == http::Method::POST {
         let response =
             start::handle_admin_provider_oauth_start_provider(state, request_context).await?;
-        return Ok(Some(attach_admin_provider_oauth_audit_response(
+        return Ok(Some(helpers::attach_admin_provider_oauth_audit_response(
             response,
             "admin_provider_oauth_authorization_started",
             "start_provider_oauth_for_provider",
@@ -88,7 +88,7 @@ pub(crate) async fn maybe_build_local_admin_provider_oauth_response(
             request_body,
         )
         .await?;
-        return Ok(Some(attach_admin_provider_oauth_audit_response(
+        return Ok(Some(helpers::attach_admin_provider_oauth_audit_response(
             response,
             "admin_provider_oauth_completed",
             "complete_provider_oauth_for_key",
@@ -100,7 +100,7 @@ pub(crate) async fn maybe_build_local_admin_provider_oauth_response(
     if route_kind == Some("refresh_key_oauth") && *method == http::Method::POST {
         let response =
             refresh::handle_admin_provider_oauth_refresh_key(state, request_context).await?;
-        return Ok(Some(attach_admin_provider_oauth_audit_response(
+        return Ok(Some(helpers::attach_admin_provider_oauth_audit_response(
             response,
             "admin_provider_oauth_refreshed",
             "refresh_provider_oauth_for_key",
@@ -116,7 +116,7 @@ pub(crate) async fn maybe_build_local_admin_provider_oauth_response(
             request_body,
         )
         .await?;
-        return Ok(Some(attach_admin_provider_oauth_audit_response(
+        return Ok(Some(helpers::attach_admin_provider_oauth_audit_response(
             response,
             "admin_provider_oauth_completed",
             "complete_provider_oauth_for_provider",
@@ -132,7 +132,7 @@ pub(crate) async fn maybe_build_local_admin_provider_oauth_response(
             request_body,
         )
         .await?;
-        return Ok(Some(attach_admin_provider_oauth_audit_response(
+        return Ok(Some(helpers::attach_admin_provider_oauth_audit_response(
             response,
             "admin_provider_oauth_refresh_token_imported",
             "import_provider_oauth_refresh_token",
@@ -145,7 +145,7 @@ pub(crate) async fn maybe_build_local_admin_provider_oauth_response(
         let response =
             batch::handle_admin_provider_oauth_batch_import(state, request_context, request_body)
                 .await?;
-        return Ok(Some(attach_admin_provider_oauth_audit_response(
+        return Ok(Some(helpers::attach_admin_provider_oauth_audit_response(
             response,
             "admin_provider_oauth_batch_import_completed",
             "batch_import_provider_oauth",
@@ -161,7 +161,7 @@ pub(crate) async fn maybe_build_local_admin_provider_oauth_response(
             request_body,
         )
         .await?;
-        return Ok(Some(attach_admin_provider_oauth_audit_response(
+        return Ok(Some(helpers::attach_admin_provider_oauth_audit_response(
             response,
             "admin_provider_oauth_batch_import_started",
             "start_provider_oauth_batch_import",
@@ -177,7 +177,7 @@ pub(crate) async fn maybe_build_local_admin_provider_oauth_response(
             request_body,
         )
         .await?;
-        return Ok(Some(attach_admin_provider_oauth_audit_response(
+        return Ok(Some(helpers::attach_admin_provider_oauth_audit_response(
             response,
             "admin_provider_oauth_device_authorization_started",
             "start_provider_oauth_device_authorization",
@@ -205,18 +205,4 @@ pub(crate) async fn maybe_build_local_admin_provider_oauth_response(
     Ok(None)
 }
 
-fn attach_admin_provider_oauth_audit_response(
-    response: Response<Body>,
-    event_name: &'static str,
-    action: &'static str,
-    target_type: &'static str,
-    target_id: Option<String>,
-) -> Response<Body> {
-    if !response.status().is_success() {
-        return response;
-    }
-    let Some(target_id) = target_id else {
-        return response;
-    };
-    attach_admin_audit_response(response, event_name, action, target_type, &target_id)
-}
+// Dispatch-specific helpers have moved to helpers.rs, so nothing remains here.

apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/refresh.rs

@@ -1,13 +1,14 @@
-use super::super::provider_oauth_quota::persist_provider_quota_refresh_state;
-use super::super::provider_oauth_refresh::{
+use super::super::quota::shared::persist_provider_quota_refresh_state;
+use super::super::refresh::{
     build_internal_control_error_response, merge_provider_oauth_refresh_failure_reason,
     normalize_provider_oauth_refresh_error_message, provider_oauth_runtime_endpoint_for_provider,
     refresh_provider_oauth_account_state_after_update,
 };
-use super::super::provider_oauth_state::is_fixed_provider_type_for_provider_oauth;
+use super::super::state::is_fixed_provider_type_for_provider_oauth;
 use crate::control::GatewayPublicRequestContext;
-use crate::handlers::admin::provider::shared::{
-    admin_provider_oauth_refresh_key_id, OAUTH_ACCOUNT_BLOCK_PREFIX, OAUTH_REFRESH_FAILED_PREFIX,
+use crate::handlers::admin::provider::shared::paths::admin_provider_oauth_refresh_key_id;
+use crate::handlers::admin::provider::shared::payloads::{
+    OAUTH_ACCOUNT_BLOCK_PREFIX, OAUTH_REFRESH_FAILED_PREFIX,
 };
 use crate::handlers::admin::shared::decrypt_catalog_secret_with_fallbacks;
 use crate::{AppState, GatewayError};

apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/start.rs

@@ -1,11 +1,11 @@
-use super::super::provider_oauth_refresh::build_internal_control_error_response;
-use super::super::provider_oauth_state::{
+use super::super::refresh::build_internal_control_error_response;
+use super::super::state::{
     admin_provider_oauth_template, build_provider_oauth_start_response,
     generate_provider_oauth_pkce_verifier, is_fixed_provider_type_for_provider_oauth,
     provider_oauth_pkce_s256, save_provider_oauth_state,
 };
 use crate::control::GatewayPublicRequestContext;
-use crate::handlers::admin::provider::shared::{
+use crate::handlers::admin::provider::shared::paths::{
     admin_provider_oauth_start_key_id, admin_provider_oauth_start_provider_id,
 };
 use crate::{AppState, GatewayError};

apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/tasks.rs

@@ -1,7 +1,7 @@
-use super::super::provider_oauth_refresh::build_internal_control_error_response;
-use super::super::provider_oauth_state::read_provider_oauth_batch_task_payload;
+use super::super::refresh::build_internal_control_error_response;
+use super::super::state::read_provider_oauth_batch_task_payload;
 use crate::control::GatewayPublicRequestContext;
-use crate::handlers::admin::provider::shared::admin_provider_oauth_batch_import_task_path;
+use crate::handlers::admin::provider::shared::paths::admin_provider_oauth_batch_import_task_path;
 use crate::handlers::admin::shared::attach_admin_audit_response;
 use crate::{AppState, GatewayError};
 use axum::{