refactor: 拆分 admin handler 大文件为模块目录，消除 shared.rs 反模式

- endpoint_keys/pool/architecture 等大文件拆分为独立模块目录
- 删除 crud/query/strategy/system 中的 shared.rs，内容归位到各自模块
- endpoints_admin/models/oauth/write 等模块拆出 payloads/responses/support 子文件
- system/core 下多个 *_routes.rs 合并到 system_routes.rs
- 更新 refactor-execution-plan 文档进度

apps/aether-gateway/src/handlers/admin/provider/ops/architectures.rs

@@ -1,5 +1,5 @@
 use crate::control::GatewayPublicRequestContext;
-use crate::handlers::admin::provider::shared::{
+use crate::handlers::admin::provider::shared::paths::{
     admin_provider_ops_architecture_id_from_path, is_admin_provider_ops_architectures_root,
 };
 use crate::GatewayError;

apps/aether-gateway/src/handlers/admin/provider/ops/mod.rs

@@ -4,9 +4,7 @@ use axum::body::{Body, Bytes};
 use axum::http::Response;
 
 mod architectures;
-mod providers;
-
-pub(crate) use self::providers::admin_provider_ops_local_action_response;
+pub(crate) mod providers;
 
 pub(crate) async fn maybe_build_local_admin_provider_ops_response(
     state: &AppState,

apps/aether-gateway/src/handlers/admin/provider/ops/providers/actions.rs

@@ -1,10 +1,10 @@
-use super::{
+use super::config::{
     admin_provider_ops_config_object, admin_provider_ops_connector_object,
     admin_provider_ops_decrypted_credentials, admin_provider_ops_uses_python_verify_fallback,
-    admin_provider_ops_value_as_f64, admin_provider_ops_verify_headers,
-    resolve_admin_provider_ops_base_url, AdminProviderOpsCheckinOutcome,
-    ADMIN_PROVIDER_OPS_ACTION_RUST_ONLY_MESSAGE,
+    resolve_admin_provider_ops_base_url,
 };
+use super::support::{AdminProviderOpsCheckinOutcome, ADMIN_PROVIDER_OPS_ACTION_RUST_ONLY_MESSAGE};
+use super::verify::{admin_provider_ops_value_as_f64, admin_provider_ops_verify_headers};
 use crate::AppState;
 use aether_data_contracts::repository::provider_catalog::{
     StoredProviderCatalogEndpoint, StoredProviderCatalogProvider,

apps/aether-gateway/src/handlers/admin/provider/ops/providers/config.rs

@@ -1,4 +1,4 @@
-use super::{AdminProviderOpsSaveConfigRequest, ADMIN_PROVIDER_OPS_SENSITIVE_FIELDS};
+use super::support::{AdminProviderOpsSaveConfigRequest, ADMIN_PROVIDER_OPS_SENSITIVE_FIELDS};
 use crate::handlers::admin::shared::{
     decrypt_catalog_secret_with_fallbacks, encrypt_catalog_secret_with_fallbacks,
 };

apps/aether-gateway/src/handlers/admin/provider/ops/providers/mod.rs

@@ -1,117 +1,6 @@
-use crate::control::GatewayPublicRequestContext;
-use crate::handlers::admin::provider::shared::{
-    admin_provider_id_for_provider_ops_balance, admin_provider_id_for_provider_ops_checkin,
-    admin_provider_id_for_provider_ops_config, admin_provider_id_for_provider_ops_connect,
-    admin_provider_id_for_provider_ops_disconnect, admin_provider_id_for_provider_ops_status,
-    admin_provider_id_for_provider_ops_verify, admin_provider_ops_action_route_parts,
-};
-use crate::handlers::admin::shared::{
-    decrypt_catalog_secret_with_fallbacks, encrypt_catalog_secret_with_fallbacks,
-};
-use crate::{AppState, GatewayError};
-use aether_data_contracts::repository::provider_catalog::{
-    StoredProviderCatalogEndpoint, StoredProviderCatalogProvider,
-};
-use axum::{
-    body::{Body, Bytes},
-    http,
-    response::{IntoResponse, Response},
-    Json,
-};
-use serde::Deserialize;
-use std::collections::BTreeMap;
-use std::time::{SystemTime, UNIX_EPOCH};
-
-mod actions;
+pub(crate) mod actions;
 mod config;
 mod routes;
+mod support;
 mod verify;
-use self::actions::admin_provider_ops_is_valid_action_type;
-pub(crate) use self::actions::admin_provider_ops_local_action_response;
-use self::config::{
-    admin_provider_ops_config_object, admin_provider_ops_connector_object,
-    admin_provider_ops_decrypted_credentials, admin_provider_ops_merge_credentials,
-    admin_provider_ops_uses_python_verify_fallback, build_admin_provider_ops_config_payload,
-    build_admin_provider_ops_saved_config_value, build_admin_provider_ops_status_payload,
-    resolve_admin_provider_ops_base_url,
-};
 pub(super) use self::routes::maybe_build_local_admin_provider_ops_providers_response;
-use self::verify::{
-    admin_provider_ops_local_verify_response, admin_provider_ops_normalized_verify_architecture_id,
-    admin_provider_ops_value_as_f64, admin_provider_ops_verify_failure,
-    admin_provider_ops_verify_headers,
-};
-
-const ADMIN_PROVIDER_OPS_SENSITIVE_FIELDS: &[&str] = &[
-    "api_key",
-    "password",
-    "refresh_token",
-    "session_token",
-    "session_cookie",
-    "token_cookie",
-    "auth_cookie",
-    "cookie_string",
-    "cookie",
-];
-const ADMIN_PROVIDER_OPS_CONNECT_RUST_ONLY_MESSAGE: &str =
-    "Provider 连接仅支持 Rust execution runtime";
-const ADMIN_PROVIDER_OPS_ACTION_RUST_ONLY_MESSAGE: &str =
-    "Provider 操作仅支持 Rust execution runtime";
-const ADMIN_PROVIDER_OPS_VERIFY_RUST_ONLY_MESSAGE: &str = "认证验证仅支持 Rust execution runtime";
-
-#[derive(Debug, Deserialize)]
-struct AdminProviderOpsSaveConfigRequest {
-    #[serde(default = "default_admin_provider_ops_architecture_id")]
-    architecture_id: String,
-    #[serde(default)]
-    base_url: Option<String>,
-    connector: AdminProviderOpsConnectorConfigRequest,
-    #[serde(default)]
-    actions: BTreeMap<String, AdminProviderOpsActionConfigRequest>,
-    #[serde(default)]
-    schedule: BTreeMap<String, String>,
-}
-
-#[derive(Debug, Deserialize)]
-struct AdminProviderOpsConnectorConfigRequest {
-    auth_type: String,
-    #[serde(default)]
-    config: serde_json::Map<String, serde_json::Value>,
-    #[serde(default)]
-    credentials: serde_json::Map<String, serde_json::Value>,
-}
-
-#[derive(Debug, Deserialize)]
-struct AdminProviderOpsActionConfigRequest {
-    #[serde(default = "default_admin_provider_ops_action_enabled")]
-    enabled: bool,
-    #[serde(default)]
-    config: serde_json::Map<String, serde_json::Value>,
-}
-
-#[derive(Debug, Deserialize)]
-struct AdminProviderOpsConnectRequest {
-    #[serde(default)]
-    credentials: Option<serde_json::Map<String, serde_json::Value>>,
-}
-
-#[derive(Debug, Deserialize)]
-struct AdminProviderOpsExecuteActionRequest {
-    #[serde(default)]
-    config: Option<serde_json::Map<String, serde_json::Value>>,
-}
-
-#[derive(Debug, Clone)]
-struct AdminProviderOpsCheckinOutcome {
-    success: Option<bool>,
-    message: String,
-    cookie_expired: bool,
-}
-
-fn default_admin_provider_ops_architecture_id() -> String {
-    "generic_api".to_string()
-}
-
-fn default_admin_provider_ops_action_enabled() -> bool {
-    true
-}

apps/aether-gateway/src/handlers/admin/provider/ops/providers/routes.rs

@@ -1,16 +1,22 @@
-use super::{
+use super::actions::{
+    admin_provider_ops_is_valid_action_type, admin_provider_ops_local_action_response,
+};
+use super::config::{
     admin_provider_ops_config_object, admin_provider_ops_connector_object,
-    admin_provider_ops_decrypted_credentials, admin_provider_ops_is_valid_action_type,
-    admin_provider_ops_local_action_response, admin_provider_ops_local_verify_response,
-    admin_provider_ops_merge_credentials, admin_provider_ops_normalized_verify_architecture_id,
-    admin_provider_ops_verify_failure, build_admin_provider_ops_config_payload,
-    build_admin_provider_ops_saved_config_value, build_admin_provider_ops_status_payload,
-    resolve_admin_provider_ops_base_url, AdminProviderOpsConnectRequest,
-    AdminProviderOpsExecuteActionRequest, AdminProviderOpsSaveConfigRequest,
-    ADMIN_PROVIDER_OPS_CONNECT_RUST_ONLY_MESSAGE,
+    admin_provider_ops_decrypted_credentials, admin_provider_ops_merge_credentials,
+    build_admin_provider_ops_config_payload, build_admin_provider_ops_saved_config_value,
+    build_admin_provider_ops_status_payload, resolve_admin_provider_ops_base_url,
+};
+use super::support::{
+    AdminProviderOpsConnectRequest, AdminProviderOpsExecuteActionRequest,
+    AdminProviderOpsSaveConfigRequest, ADMIN_PROVIDER_OPS_CONNECT_RUST_ONLY_MESSAGE,
+};
+use super::verify::{
+    admin_provider_ops_local_verify_response, admin_provider_ops_normalized_verify_architecture_id,
+    admin_provider_ops_verify_failure,
 };
 use crate::control::GatewayPublicRequestContext;
-use crate::handlers::admin::provider::shared::{
+use crate::handlers::admin::provider::shared::paths::{
     admin_provider_id_for_provider_ops_balance, admin_provider_id_for_provider_ops_checkin,
     admin_provider_id_for_provider_ops_config, admin_provider_id_for_provider_ops_connect,
     admin_provider_id_for_provider_ops_disconnect, admin_provider_id_for_provider_ops_status,

apps/aether-gateway/src/handlers/admin/provider/ops/providers/support.rs

@@ -0,0 +1,77 @@
+use serde::Deserialize;
+use std::collections::BTreeMap;
+
+pub(super) const ADMIN_PROVIDER_OPS_SENSITIVE_FIELDS: &[&str] = &[
+    "api_key",
+    "password",
+    "refresh_token",
+    "session_token",
+    "session_cookie",
+    "token_cookie",
+    "auth_cookie",
+    "cookie_string",
+    "cookie",
+];
+pub(super) const ADMIN_PROVIDER_OPS_CONNECT_RUST_ONLY_MESSAGE: &str =
+    "Provider 连接仅支持 Rust execution runtime";
+pub(super) const ADMIN_PROVIDER_OPS_ACTION_RUST_ONLY_MESSAGE: &str =
+    "Provider 操作仅支持 Rust execution runtime";
+pub(super) const ADMIN_PROVIDER_OPS_VERIFY_RUST_ONLY_MESSAGE: &str =
+    "认证验证仅支持 Rust execution runtime";
+
+#[derive(Debug, Deserialize)]
+pub(super) struct AdminProviderOpsSaveConfigRequest {
+    #[serde(default = "default_admin_provider_ops_architecture_id")]
+    pub(crate) architecture_id: String,
+    #[serde(default)]
+    pub(crate) base_url: Option<String>,
+    pub(crate) connector: AdminProviderOpsConnectorConfigRequest,
+    #[serde(default)]
+    pub(crate) actions: BTreeMap<String, AdminProviderOpsActionConfigRequest>,
+    #[serde(default)]
+    pub(crate) schedule: BTreeMap<String, String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub(super) struct AdminProviderOpsConnectorConfigRequest {
+    pub(crate) auth_type: String,
+    #[serde(default)]
+    pub(crate) config: serde_json::Map<String, serde_json::Value>,
+    #[serde(default)]
+    pub(crate) credentials: serde_json::Map<String, serde_json::Value>,
+}
+
+#[derive(Debug, Deserialize)]
+pub(super) struct AdminProviderOpsActionConfigRequest {
+    #[serde(default = "default_admin_provider_ops_action_enabled")]
+    pub(crate) enabled: bool,
+    #[serde(default)]
+    pub(crate) config: serde_json::Map<String, serde_json::Value>,
+}
+
+#[derive(Debug, Deserialize)]
+pub(super) struct AdminProviderOpsConnectRequest {
+    #[serde(default)]
+    pub(crate) credentials: Option<serde_json::Map<String, serde_json::Value>>,
+}
+
+#[derive(Debug, Deserialize)]
+pub(super) struct AdminProviderOpsExecuteActionRequest {
+    #[serde(default)]
+    pub(crate) config: Option<serde_json::Map<String, serde_json::Value>>,
+}
+
+#[derive(Debug, Clone)]
+pub(super) struct AdminProviderOpsCheckinOutcome {
+    pub(crate) success: Option<bool>,
+    pub(crate) message: String,
+    pub(crate) cookie_expired: bool,
+}
+
+fn default_admin_provider_ops_architecture_id() -> String {
+    "generic_api".to_string()
+}
+
+fn default_admin_provider_ops_action_enabled() -> bool {
+    true
+}

apps/aether-gateway/src/handlers/admin/provider/ops/providers/verify.rs

@@ -1,4 +1,4 @@
-use super::ADMIN_PROVIDER_OPS_VERIFY_RUST_ONLY_MESSAGE;
+use super::support::ADMIN_PROVIDER_OPS_VERIFY_RUST_ONLY_MESSAGE;
 use crate::AppState;
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
 use regex::Regex;