refactor: 大规模模块拆分与重组，新增 aether-admin crate

- 新建独立 aether-admin crate 承载 admin 相关共享契约与纯辅助函数
- 拆分 ai_pipeline 下 kiro/private_envelope/conversion/planner 等大文件为子模块目录
- 重组 admin handlers 各业务域（billing/oauth/provider/system/users 等）为目录结构，移除 shared.rs/builders.rs 等反模式
- 移除 ai_pipeline runtime adapters 旧实现（claude/openai/gemini/kiro/vertex/antigravity 等），改由 provider transport 统一承载
- 移除 control_facade/execution_facade/auth_snapshot_facade 等冗余 facade 层
- 拆分 query/billing 与 query/monitoring 模块、state/runtime/payments 与 security 模块
- 扩展架构测试覆盖 admin_billing/admin_model/admin_users 等新模块
- 删除 docs/architecture/refactor-execution-plan.md 已完成的执行计划文档

apps/aether-gateway/src/handlers/admin/auth/ldap/builders.rs

@@ -1,8 +1,6 @@
 use super::shared::*;
-use crate::handlers::admin::shared::{
-    decrypt_catalog_secret_with_fallbacks, encrypt_catalog_secret_with_fallbacks,
-};
-use crate::{AppState, GatewayError};
+use crate::handlers::admin::request::AdminAppState;
+use crate::GatewayError;
 use serde::Deserialize;
 
 #[derive(Debug, Deserialize)]
@@ -69,7 +67,7 @@ pub(super) struct AdminLdapConnectionTestConfig {
 }
 
 pub(super) async fn build_admin_ldap_update_config(
-    state: &AppState,
+    state: &AdminAppState<'_>,
     payload: AdminLdapConfigUpdateRequest,
 ) -> Result<aether_data::repository::auth_modules::StoredLdapModuleConfig, String> {
     let server_url = admin_ldap_trim_required(payload.server_url, "LDAP 服务器地址不能为空")?;
@@ -139,7 +137,7 @@ pub(super) async fn build_admin_ldap_update_config(
 
     let bind_password_encrypted = match bind_password {
         Some(value) if value.is_empty() => None,
-        Some(value) => encrypt_catalog_secret_with_fallbacks(state, &value),
+        Some(value) => state.encrypt_catalog_secret_with_fallbacks(&value),
         None => existing.and_then(|config| config.bind_password_encrypted),
     };
     if bind_password_update_requested && bind_password_encrypted.is_none() {
@@ -165,7 +163,7 @@ pub(super) async fn build_admin_ldap_update_config(
 }
 
 pub(super) async fn build_admin_ldap_test_config(
-    state: &AppState,
+    state: &AdminAppState<'_>,
     payload: AdminLdapConfigTestRequest,
 ) -> Result<Option<AdminLdapConnectionTestConfig>, String> {
     if let Some(value) = payload.user_search_filter.as_deref() {
@@ -337,7 +335,7 @@ fn admin_ldap_validate_search_filter(value: &str) -> Result<(), String> {
 }
 
 fn admin_ldap_read_saved_bind_password(
-    state: &AppState,
+    state: &AdminAppState<'_>,
     config: &aether_data::repository::auth_modules::StoredLdapModuleConfig,
 ) -> Option<String> {
     config
@@ -346,7 +344,8 @@ fn admin_ldap_read_saved_bind_password(
         .map(str::trim)
         .filter(|value| !value.is_empty())
         .and_then(|value| {
-            decrypt_catalog_secret_with_fallbacks(state.encryption_key(), value)
+            state
+                .decrypt_catalog_secret_with_fallbacks(value)
                 .or_else(|| Some(value.to_string()))
         })
         .filter(|value| !value.trim().is_empty())