refactor: 拆分 admin handler 大文件为模块目录，消除 shared.rs 反模式

- endpoint_keys/pool/architecture 等大文件拆分为独立模块目录
- 删除 crud/query/strategy/system 中的 shared.rs，内容归位到各自模块
- endpoints_admin/models/oauth/write 等模块拆出 payloads/responses/support 子文件
- system/core 下多个 *_routes.rs 合并到 system_routes.rs
- 更新 refactor-execution-plan 文档进度

apps/aether-gateway/src/handlers/admin/provider/write/normalize.rs

@@ -0,0 +1,48 @@
+pub(crate) fn normalize_provider_type_input(value: &str) -> Result<String, String> {
+    let normalized = value.trim().to_ascii_lowercase();
+    match normalized.as_str() {
+        "custom" | "claude_code" | "kiro" | "codex" | "gemini_cli" | "antigravity"
+        | "vertex_ai" => Ok(normalized),
+        _ => Err(
+            "provider_type 仅支持 custom / claude_code / kiro / codex / gemini_cli / antigravity / vertex_ai"
+                .to_string(),
+        ),
+    }
+}
+
+pub(crate) fn normalize_auth_type(value: Option<&str>) -> Result<String, String> {
+    let auth_type = value.unwrap_or("api_key").trim().to_ascii_lowercase();
+    match auth_type.as_str() {
+        "api_key" | "service_account" | "oauth" => Ok(auth_type),
+        _ => Err("auth_type 仅支持 api_key / service_account / oauth".to_string()),
+    }
+}
+
+pub(crate) fn validate_vertex_api_formats(
+    provider_type: &str,
+    auth_type: &str,
+    api_formats: &[String],
+) -> Result<(), String> {
+    if !provider_type.trim().eq_ignore_ascii_case("vertex_ai") {
+        return Ok(());
+    }
+
+    let allowed = match auth_type {
+        "api_key" => &["gemini:chat"][..],
+        "service_account" | "vertex_ai" => &["claude:chat", "gemini:chat"][..],
+        _ => return Ok(()),
+    };
+    let invalid = api_formats
+        .iter()
+        .filter(|value| !allowed.contains(&value.as_str()))
+        .cloned()
+        .collect::<Vec<_>>();
+    if invalid.is_empty() {
+        return Ok(());
+    }
+    Err(format!(
+        "Vertex {auth_type} 不支持以下 API 格式: {}；允许: {}",
+        invalid.join(", "),
+        allowed.join(", ")
+    ))
+}