refactor: 大规模模块拆分与重组，新增 aether-admin crate

- 新建独立 aether-admin crate 承载 admin 相关共享契约与纯辅助函数
- 拆分 ai_pipeline 下 kiro/private_envelope/conversion/planner 等大文件为子模块目录
- 重组 admin handlers 各业务域（billing/oauth/provider/system/users 等）为目录结构，移除 shared.rs/builders.rs 等反模式
- 移除 ai_pipeline runtime adapters 旧实现（claude/openai/gemini/kiro/vertex/antigravity 等），改由 provider transport 统一承载
- 移除 control_facade/execution_facade/auth_snapshot_facade 等冗余 facade 层
- 拆分 query/billing 与 query/monitoring 模块、state/runtime/payments 与 security 模块
- 扩展架构测试覆盖 admin_billing/admin_model/admin_users 等新模块
- 删除 docs/architecture/refactor-execution-plan.md 已完成的执行计划文档

apps/aether-gateway/src/handlers/admin/billing/payments/callbacks.rs

@@ -3,9 +3,9 @@ use super::{
     build_admin_payments_bad_request_response, parse_admin_payments_limit,
     parse_admin_payments_offset,
 };
-use crate::control::GatewayPublicRequestContext;
+use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
 use crate::handlers::admin::shared::query_param_value;
-use crate::{AppState, GatewayError};
+use crate::GatewayError;
 use axum::{
     body::Body,
     response::{IntoResponse, Response},
@@ -14,8 +14,8 @@ use axum::{
 use serde_json::json;
 
 pub(super) async fn maybe_build_local_admin_payment_callbacks_response(
-    state: &AppState,
-    request_context: &GatewayPublicRequestContext,
+    state: &AdminAppState<'_>,
+    request_context: &AdminRequestContext<'_>,
     route_kind: Option<&str>,
 ) -> Result<Option<Response<Body>>, GatewayError> {
     match route_kind {
@@ -27,10 +27,10 @@ pub(super) async fn maybe_build_local_admin_payment_callbacks_response(
 }
 
 async fn build_admin_payment_callbacks_response(
-    state: &AppState,
-    request_context: &GatewayPublicRequestContext,
+    state: &AdminAppState<'_>,
+    request_context: &AdminRequestContext<'_>,
 ) -> Result<Response<Body>, GatewayError> {
-    let query = request_context.request_query_string.as_deref();
+    let query = request_context.query_string();
     let limit = match parse_admin_payments_limit(query) {
         Ok(value) => value,
         Err(detail) => return Ok(build_admin_payments_bad_request_response(detail)),

apps/aether-gateway/src/handlers/admin/billing/payments/mod.rs

@@ -1,5 +1,5 @@
-use crate::control::GatewayPublicRequestContext;
-use crate::{AppState, GatewayError};
+use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
+use crate::GatewayError;
 use axum::{body::Body, response::Response};
 
 mod callbacks;
@@ -21,8 +21,8 @@ use self::shared::{
 };
 
 pub(crate) async fn maybe_build_local_admin_payments_response(
-    state: &AppState,
-    request_context: &GatewayPublicRequestContext,
+    state: &AdminAppState<'_>,
+    request_context: &AdminRequestContext<'_>,
     request_body: Option<&axum::body::Bytes>,
 ) -> Result<Option<Response<Body>>, GatewayError> {
     routes::maybe_build_local_admin_payments_response(state, request_context, request_body).await

apps/aether-gateway/src/handlers/admin/billing/payments/orders.rs

@@ -7,9 +7,9 @@ use super::{
     normalize_admin_payment_positive_number, parse_admin_payments_limit,
     parse_admin_payments_offset, AdminPaymentOrderCreditRequest,
 };
-use crate::control::GatewayPublicRequestContext;
+use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
 use crate::handlers::admin::shared::{attach_admin_audit_response, query_param_value};
-use crate::{AppState, GatewayError};
+use crate::GatewayError;
 use axum::{
     body::Body,
     response::{IntoResponse, Response},
@@ -18,8 +18,8 @@ use axum::{
 use serde_json::json;
 
 pub(super) async fn maybe_build_local_admin_payment_orders_response(
-    state: &AppState,
-    request_context: &GatewayPublicRequestContext,
+    state: &AdminAppState<'_>,
+    request_context: &AdminRequestContext<'_>,
     request_body: Option<&axum::body::Bytes>,
     route_kind: Option<&str>,
 ) -> Result<Option<Response<Body>>, GatewayError> {
@@ -44,10 +44,10 @@ pub(super) async fn maybe_build_local_admin_payment_orders_response(
 }
 
 async fn build_admin_payment_list_orders_response(
-    state: &AppState,
-    request_context: &GatewayPublicRequestContext,
+    state: &AdminAppState<'_>,
+    request_context: &AdminRequestContext<'_>,
 ) -> Result<Response<Body>, GatewayError> {
-    let query = request_context.request_query_string.as_deref();
+    let query = request_context.query_string();
     let limit = match parse_admin_payments_limit(query) {
         Ok(value) => value,
         Err(detail) => return Ok(build_admin_payments_bad_request_response(detail)),
@@ -83,11 +83,10 @@ async fn build_admin_payment_list_orders_response(
 }
 
 async fn build_admin_payment_get_order_response(
-    state: &AppState,
-    request_context: &GatewayPublicRequestContext,
+    state: &AdminAppState<'_>,
+    request_context: &AdminRequestContext<'_>,
 ) -> Result<Response<Body>, GatewayError> {
-    let Some(order_id) = admin_payment_order_id_from_detail_path(&request_context.request_path)
-    else {
+    let Some(order_id) = admin_payment_order_id_from_detail_path(request_context.path()) else {
         return Ok(build_admin_payment_order_not_found_response());
     };
     match state.read_admin_payment_order(&order_id).await? {
@@ -110,11 +109,10 @@ async fn build_admin_payment_get_order_response(
 }
 
 async fn build_admin_payment_expire_order_response(
-    state: &AppState,
-    request_context: &GatewayPublicRequestContext,
+    state: &AdminAppState<'_>,
+    request_context: &AdminRequestContext<'_>,
 ) -> Result<Response<Body>, GatewayError> {
-    let Some(order_id) =
-        admin_payment_order_id_from_suffix_path(&request_context.request_path, "/expire")
+    let Some(order_id) = admin_payment_order_id_from_suffix_path(request_context.path(), "/expire")
     else {
         return Ok(build_admin_payment_order_not_found_response());
     };
@@ -147,12 +145,11 @@ async fn build_admin_payment_expire_order_response(
 }
 
 async fn build_admin_payment_credit_order_response(
-    state: &AppState,
-    request_context: &GatewayPublicRequestContext,
+    state: &AdminAppState<'_>,
+    request_context: &AdminRequestContext<'_>,
     request_body: Option<&axum::body::Bytes>,
 ) -> Result<Response<Body>, GatewayError> {
-    let Some(order_id) =
-        admin_payment_order_id_from_suffix_path(&request_context.request_path, "/credit")
+    let Some(order_id) = admin_payment_order_id_from_suffix_path(request_context.path(), "/credit")
     else {
         return Ok(build_admin_payment_order_not_found_response());
     };
@@ -241,11 +238,10 @@ async fn build_admin_payment_credit_order_response(
 }
 
 async fn build_admin_payment_fail_order_response(
-    state: &AppState,
-    request_context: &GatewayPublicRequestContext,
+    state: &AdminAppState<'_>,
+    request_context: &AdminRequestContext<'_>,
 ) -> Result<Response<Body>, GatewayError> {
-    let Some(order_id) =
-        admin_payment_order_id_from_suffix_path(&request_context.request_path, "/fail")
+    let Some(order_id) = admin_payment_order_id_from_suffix_path(request_context.path(), "/fail")
     else {
         return Ok(build_admin_payment_order_not_found_response());
     };

apps/aether-gateway/src/handlers/admin/billing/payments/routes.rs

@@ -3,16 +3,16 @@ use super::{
     callbacks::maybe_build_local_admin_payment_callbacks_response,
     orders::maybe_build_local_admin_payment_orders_response,
 };
-use crate::control::GatewayPublicRequestContext;
-use crate::{AppState, GatewayError};
+use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
+use crate::GatewayError;
 use axum::{body::Body, http, response::Response};
 
 pub(super) async fn maybe_build_local_admin_payments_response(
-    state: &AppState,
-    request_context: &GatewayPublicRequestContext,
+    state: &AdminAppState<'_>,
+    request_context: &AdminRequestContext<'_>,
     request_body: Option<&axum::body::Bytes>,
 ) -> Result<Option<Response<Body>>, GatewayError> {
-    let Some(decision) = request_context.control_decision.as_ref() else {
+    let Some(decision) = request_context.decision() else {
         return Ok(None);
     };
 
@@ -20,30 +20,30 @@ pub(super) async fn maybe_build_local_admin_payments_response(
         return Ok(None);
     }
 
-    let normalized_path = request_context.request_path.trim_end_matches('/');
+    let normalized_path = request_context.path().trim_end_matches('/');
     let path = if normalized_path.is_empty() {
-        request_context.request_path.as_str()
+        request_context.path()
     } else {
         normalized_path
     };
-    let is_payments_route = (request_context.request_method == http::Method::GET
+    let is_payments_route = (request_context.method() == http::Method::GET
         && path == "/api/admin/payments/orders")
-        || (request_context.request_method == http::Method::GET
+        || (request_context.method() == http::Method::GET
             && path.starts_with("/api/admin/payments/orders/")
             && path.matches('/').count() == 5)
-        || (request_context.request_method == http::Method::POST
+        || (request_context.method() == http::Method::POST
             && path.starts_with("/api/admin/payments/orders/")
             && path.ends_with("/expire")
             && path.matches('/').count() == 6)
-        || (request_context.request_method == http::Method::POST
+        || (request_context.method() == http::Method::POST
             && path.starts_with("/api/admin/payments/orders/")
             && path.ends_with("/credit")
             && path.matches('/').count() == 6)
-        || (request_context.request_method == http::Method::POST
+        || (request_context.method() == http::Method::POST
             && path.starts_with("/api/admin/payments/orders/")
             && path.ends_with("/fail")
             && path.matches('/').count() == 6)
-        || (request_context.request_method == http::Method::GET
+        || (request_context.method() == http::Method::GET
             && path == "/api/admin/payments/callbacks");
 
     if !is_payments_route {

apps/aether-gateway/src/handlers/admin/billing/payments/shared.rs

@@ -1,4 +1,4 @@
-use crate::control::GatewayPublicRequestContext;
+use crate::handlers::admin::request::AdminRequestContext;
 use crate::handlers::admin::shared::{query_param_value, unix_secs_to_rfc3339};
 use crate::{GatewayAdminPaymentCallbackView, GatewayError};
 use axum::{
@@ -175,11 +175,10 @@ pub(super) fn normalize_admin_payment_positive_number(
 }
 
 pub(super) fn admin_payment_operator_id(
-    request_context: &GatewayPublicRequestContext,
+    request_context: &AdminRequestContext<'_>,
 ) -> Option<String> {
     request_context
-        .control_decision
-        .as_ref()
+        .decision()
         .and_then(|decision| decision.admin_principal.as_ref())
         .map(|principal| principal.user_id.clone())
 }