refactor: 大规模模块拆分与重组，新增 aether-admin crate

- 新建独立 aether-admin crate 承载 admin 相关共享契约与纯辅助函数
- 拆分 ai_pipeline 下 kiro/private_envelope/conversion/planner 等大文件为子模块目录
- 重组 admin handlers 各业务域（billing/oauth/provider/system/users 等）为目录结构，移除 shared.rs/builders.rs 等反模式
- 移除 ai_pipeline runtime adapters 旧实现（claude/openai/gemini/kiro/vertex/antigravity 等），改由 provider transport 统一承载
- 移除 control_facade/execution_facade/auth_snapshot_facade 等冗余 facade 层
- 拆分 query/billing 与 query/monitoring 模块、state/runtime/payments 与 security 模块
- 扩展架构测试覆盖 admin_billing/admin_model/admin_users 等新模块
- 删除 docs/architecture/refactor-execution-plan.md 已完成的执行计划文档

apps/aether-gateway/src/execution_runtime/stream/execution.rs

@@ -24,10 +24,10 @@ use self::execution_failures::{
     build_stream_failure_from_execution_error, build_stream_failure_report,
     handle_prefetch_stream_failure, submit_midstream_stream_failure, StreamFailureReport,
 };
-use crate::ai_pipeline::adaptation::private_envelope::{
-    maybe_build_provider_private_stream_normalizer, normalize_provider_private_report_context,
+use crate::ai_pipeline_api::{
+    maybe_build_provider_private_stream_normalizer, maybe_build_stream_response_rewriter,
+    normalize_provider_private_report_context,
 };
-use crate::ai_pipeline::finalize::maybe_build_stream_response_rewriter;
 use crate::api::response::{
     attach_control_metadata_headers, build_client_response, build_client_response_from_parts,
 };

apps/aether-gateway/src/execution_runtime/submission.rs

@@ -1,9 +1,12 @@
-use crate::ai_pipeline::adaptation::private_envelope::normalize_provider_private_response_value as unwrap_local_finalize_response_value;
-use crate::ai_pipeline::conversion::{
+#[cfg(test)]
+use crate::ai_pipeline_api::core_success_background_report_kind;
+use crate::ai_pipeline_api::{
     build_core_error_body_for_client_format, core_error_background_report_kind,
-    core_error_default_client_api_format, is_core_error_finalize_kind, LocalCoreSyncErrorKind,
+    core_error_default_client_api_format, is_core_error_finalize_kind,
+    maybe_compile_sync_finalize_response,
+    normalize_provider_private_response_value as unwrap_local_finalize_response_value,
+    LocalCoreSyncErrorKind,
 };
-use crate::ai_pipeline::finalize::maybe_compile_sync_finalize_response;
 use crate::api::response::build_client_response_from_parts;
 use crate::control::GatewayControlDecision;
 use crate::usage::spawn_sync_report;
@@ -240,7 +243,7 @@ fn resolve_local_sync_source_body_json(
 
     if let Some(report_context) = payload.report_context.as_ref() {
         if let Some(unwrapped) =
-            unwrap_local_finalize_response_value(body_json.clone(), report_context)?
+            unwrap_local_finalize_response_value(body_json.clone(), report_context)
         {
             return Ok(Some(unwrapped));
         }
@@ -286,8 +289,7 @@ pub(crate) fn resolve_core_error_background_report_kind(report_kind: &str) -> Op
 
 #[cfg(test)]
 pub(crate) fn resolve_core_success_background_report_kind(report_kind: &str) -> Option<String> {
-    crate::ai_pipeline::conversion::core_success_background_report_kind(report_kind)
-        .map(ToOwned::to_owned)
+    core_success_background_report_kind(report_kind).map(ToOwned::to_owned)
 }
 
 fn resolve_local_sync_error_status_code(status_code: u16, body_json: &serde_json::Value) -> u16 {

apps/aether-gateway/src/execution_runtime/sync/execution.rs

@@ -8,8 +8,10 @@ use axum::http::Response;
 use base64::Engine as _;
 use tracing::warn;
 
-use crate::ai_pipeline::contracts::implicit_sync_finalize_report_kind;
-use crate::ai_pipeline::finalize::maybe_build_sync_finalize_outcome;
+use crate::ai_pipeline_api::{
+    implicit_sync_finalize_report_kind, maybe_build_sync_finalize_outcome,
+    LocalCoreSyncFinalizeOutcome,
+};
 use crate::api::response::{
     attach_control_metadata_headers, build_client_response, build_client_response_from_parts,
 };
@@ -46,7 +48,7 @@ pub(crate) use response::{
 
 struct ImplicitSyncFinalizeOutcome {
     payload: GatewaySyncReportRequest,
-    outcome: crate::ai_pipeline::finalize::LocalCoreSyncFinalizeOutcome,
+    outcome: LocalCoreSyncFinalizeOutcome,
 }
 
 async fn record_sync_terminal_usage(

apps/aether-gateway/src/execution_runtime/tests.rs

@@ -3,12 +3,11 @@ use axum::http::Request;
 use base64::Engine as _;
 use serde_json::json;
 
-use crate::ai_pipeline::contracts::GatewayControlSyncDecisionResponse;
-use crate::ai_pipeline::planner::plan_builders::{
+use crate::ai_pipeline_api::{
     build_gemini_stream_plan_from_decision, build_gemini_sync_plan_from_decision,
     build_openai_cli_stream_plan_from_decision, build_openai_cli_sync_plan_from_decision,
     build_passthrough_sync_plan_from_decision, build_standard_stream_plan_from_decision,
-    build_standard_sync_plan_from_decision,
+    build_standard_sync_plan_from_decision, GatewayControlSyncDecisionResponse,
 };
 use crate::execution_runtime::submission::{
     build_best_effort_local_core_error_body, resolve_core_error_background_report_kind,