refactor: 大规模模块拆分与重组，新增 aether-admin crate

- 新建独立 aether-admin crate 承载 admin 相关共享契约与纯辅助函数
- 拆分 ai_pipeline 下 kiro/private_envelope/conversion/planner 等大文件为子模块目录
- 重组 admin handlers 各业务域（billing/oauth/provider/system/users 等）为目录结构，移除 shared.rs/builders.rs 等反模式
- 移除 ai_pipeline runtime adapters 旧实现（claude/openai/gemini/kiro/vertex/antigravity 等），改由 provider transport 统一承载
- 移除 control_facade/execution_facade/auth_snapshot_facade 等冗余 facade 层
- 拆分 query/billing 与 query/monitoring 模块、state/runtime/payments 与 security 模块
- 扩展架构测试覆盖 admin_billing/admin_model/admin_users 等新模块
- 删除 docs/architecture/refactor-execution-plan.md 已完成的执行计划文档

apps/aether-gateway/src/handlers/admin/auth/oauth_routes.rs

@@ -3,9 +3,9 @@ use super::oauth_config::{
     build_admin_oauth_provider_payload, build_admin_oauth_supported_types_payload,
     build_admin_oauth_upsert_record, AdminOAuthProviderUpsertRequest,
 };
-use crate::control::GatewayPublicRequestContext;
+use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
 use crate::handlers::admin::shared::{attach_admin_audit_response, build_proxy_error_response};
-use crate::{AppState, GatewayError};
+use crate::GatewayError;
 use axum::{
     body::{Body, Bytes},
     http,
@@ -15,11 +15,11 @@ use axum::{
 use serde_json::json;
 
 pub(crate) async fn maybe_build_local_admin_oauth_response(
-    state: &AppState,
-    request_context: &GatewayPublicRequestContext,
+    state: &AdminAppState<'_>,
+    request_context: &AdminRequestContext<'_>,
     request_body: Option<&Bytes>,
 ) -> Result<Option<Response<Body>>, GatewayError> {
-    let Some(decision) = request_context.control_decision.as_ref() else {
+    let Some(decision) = request_context.decision() else {
         return Ok(None);
     };
     if decision.route_family.as_deref() != Some("oauth_manage") {
@@ -27,8 +27,8 @@ pub(crate) async fn maybe_build_local_admin_oauth_response(
     }
 
     if decision.route_kind.as_deref() == Some("supported_types")
-        && request_context.request_method == http::Method::GET
-        && request_context.request_path == "/api/admin/oauth/supported-types"
+        && request_context.method() == http::Method::GET
+        && request_context.path() == "/api/admin/oauth/supported-types"
     {
         return Ok(Some(
             Json(build_admin_oauth_supported_types_payload()).into_response(),
@@ -36,9 +36,9 @@ pub(crate) async fn maybe_build_local_admin_oauth_response(
     }
 
     if decision.route_kind.as_deref() == Some("list_providers")
-        && request_context.request_method == http::Method::GET
+        && request_context.method() == http::Method::GET
         && matches!(
-            request_context.request_path.as_str(),
+            request_context.path(),
             "/api/admin/oauth/providers" | "/api/admin/oauth/providers/"
         )
     {
@@ -59,10 +59,9 @@ pub(crate) async fn maybe_build_local_admin_oauth_response(
     }
 
     if decision.route_kind.as_deref() == Some("get_provider")
-        && request_context.request_method == http::Method::GET
+        && request_context.method() == http::Method::GET
     {
-        let Some(provider_type) =
-            admin_oauth_provider_type_from_path(&request_context.request_path)
+        let Some(provider_type) = admin_oauth_provider_type_from_path(request_context.path())
         else {
             return Ok(Some(
                 (
@@ -91,10 +90,9 @@ pub(crate) async fn maybe_build_local_admin_oauth_response(
     }
 
     if decision.route_kind.as_deref() == Some("upsert_provider")
-        && request_context.request_method == http::Method::PUT
+        && request_context.method() == http::Method::PUT
     {
-        let Some(provider_type) =
-            admin_oauth_provider_type_from_path(&request_context.request_path)
+        let Some(provider_type) = admin_oauth_provider_type_from_path(request_context.path())
         else {
             return Ok(Some(build_proxy_error_response(
                 http::StatusCode::BAD_REQUEST,
@@ -172,10 +170,9 @@ pub(crate) async fn maybe_build_local_admin_oauth_response(
     }
 
     if decision.route_kind.as_deref() == Some("delete_provider")
-        && request_context.request_method == http::Method::DELETE
+        && request_context.method() == http::Method::DELETE
     {
-        let Some(provider_type) =
-            admin_oauth_provider_type_from_path(&request_context.request_path)
+        let Some(provider_type) = admin_oauth_provider_type_from_path(request_context.path())
         else {
             return Ok(Some(build_proxy_error_response(
                 http::StatusCode::BAD_REQUEST,
@@ -229,10 +226,9 @@ pub(crate) async fn maybe_build_local_admin_oauth_response(
     }
 
     if decision.route_kind.as_deref() == Some("test_provider")
-        && request_context.request_method == http::Method::POST
+        && request_context.method() == http::Method::POST
     {
-        let Some(provider_type) =
-            admin_oauth_test_provider_type_from_path(&request_context.request_path)
+        let Some(provider_type) = admin_oauth_test_provider_type_from_path(request_context.path())
         else {
             return Ok(Some(
                 (