refactor: 大规模模块拆分与重组，新增 aether-admin crate

- 新建独立 aether-admin crate 承载 admin 相关共享契约与纯辅助函数
- 拆分 ai_pipeline 下 kiro/private_envelope/conversion/planner 等大文件为子模块目录
- 重组 admin handlers 各业务域（billing/oauth/provider/system/users 等）为目录结构，移除 shared.rs/builders.rs 等反模式
- 移除 ai_pipeline runtime adapters 旧实现（claude/openai/gemini/kiro/vertex/antigravity 等），改由 provider transport 统一承载
- 移除 control_facade/execution_facade/auth_snapshot_facade 等冗余 facade 层
- 拆分 query/billing 与 query/monitoring 模块、state/runtime/payments 与 security 模块
- 扩展架构测试覆盖 admin_billing/admin_model/admin_users 等新模块
- 删除 docs/architecture/refactor-execution-plan.md 已完成的执行计划文档

apps/aether-gateway/src/handlers/admin/endpoint/health_builders/keys.rs

@@ -1,11 +1,11 @@
+use crate::handlers::admin::request::AdminAppState;
 use crate::handlers::public::provider_key_api_formats;
-use crate::AppState;
 use aether_scheduler_core::count_recent_rpm_requests_for_provider_key_since;
 use serde_json::json;
 use std::time::{SystemTime, UNIX_EPOCH};
 
 pub(crate) async fn build_admin_key_health_payload(
-    state: &AppState,
+    state: &AdminAppState<'_>,
     key_id: &str,
     api_format: Option<&str>,
 ) -> Option<serde_json::Value> {
@@ -172,7 +172,7 @@ pub(crate) async fn build_admin_key_health_payload(
 }
 
 pub(crate) async fn build_admin_key_rpm_payload(
-    state: &AppState,
+    state: &AdminAppState<'_>,
     key_id: &str,
 ) -> Option<serde_json::Value> {
     if !state.has_provider_catalog_data_reader() {
@@ -225,7 +225,7 @@ fn default_key_circuit_payload() -> serde_json::Value {
 }
 
 pub(crate) async fn recover_admin_key_health(
-    state: &AppState,
+    state: &AdminAppState<'_>,
     key_id: &str,
     api_format: Option<&str>,
 ) -> Option<serde_json::Value> {
@@ -295,7 +295,9 @@ pub(crate) async fn recover_admin_key_health(
     }))
 }
 
-pub(crate) async fn recover_all_admin_key_health(state: &AppState) -> Option<serde_json::Value> {
+pub(crate) async fn recover_all_admin_key_health(
+    state: &AdminAppState<'_>,
+) -> Option<serde_json::Value> {
     if !state.has_provider_catalog_data_reader() {
         return None;
     }

apps/aether-gateway/src/handlers/admin/endpoint/health_builders/mod.rs

@@ -1,9 +1,9 @@
 mod keys;
 mod status;
 
-pub(super) use self::keys::{
+pub(crate) use self::keys::{
     build_admin_key_health_payload, build_admin_key_rpm_payload, recover_admin_key_health,
     recover_all_admin_key_health,
 };
 pub(crate) use self::status::build_admin_endpoint_health_status_payload;
-pub(super) use self::status::build_admin_health_summary_payload;
+pub(crate) use self::status::build_admin_health_summary_payload;

apps/aether-gateway/src/handlers/admin/endpoint/health_builders/status.rs

@@ -1,8 +1,8 @@
+use crate::handlers::admin::request::AdminAppState;
 use crate::handlers::admin::shared::unix_secs_to_rfc3339;
 use crate::handlers::public::{
     api_format_display_name, build_public_health_timeline, provider_key_api_formats,
 };
-use crate::AppState;
 use aether_data_contracts::repository::candidates::PublicHealthTimelineBucket;
 use aether_scheduler_core::{is_provider_key_circuit_open, provider_key_health_score};
 use serde_json::json;
@@ -10,7 +10,7 @@ use std::collections::{BTreeMap, BTreeSet};
 use std::time::{SystemTime, UNIX_EPOCH};
 
 pub(crate) async fn build_admin_endpoint_health_status_payload(
-    state: &AppState,
+    state: &AdminAppState<'_>,
     lookback_hours: u64,
 ) -> Option<serde_json::Value> {
     if !state.has_provider_catalog_data_reader() || !state.has_request_candidate_data_reader() {
@@ -210,7 +210,7 @@ pub(crate) async fn build_admin_endpoint_health_status_payload(
 }
 
 pub(crate) async fn build_admin_health_summary_payload(
-    state: &AppState,
+    state: &AdminAppState<'_>,
 ) -> Option<serde_json::Value> {
     if !state.has_provider_catalog_data_reader() {
         return None;