refactor: 大规模模块拆分与重组，新增 aether-admin crate

- 新建独立 aether-admin crate 承载 admin 相关共享契约与纯辅助函数
- 拆分 ai_pipeline 下 kiro/private_envelope/conversion/planner 等大文件为子模块目录
- 重组 admin handlers 各业务域（billing/oauth/provider/system/users 等）为目录结构，移除 shared.rs/builders.rs 等反模式
- 移除 ai_pipeline runtime adapters 旧实现（claude/openai/gemini/kiro/vertex/antigravity 等），改由 provider transport 统一承载
- 移除 control_facade/execution_facade/auth_snapshot_facade 等冗余 facade 层
- 拆分 query/billing 与 query/monitoring 模块、state/runtime/payments 与 security 模块
- 扩展架构测试覆盖 admin_billing/admin_model/admin_users 等新模块
- 删除 docs/architecture/refactor-execution-plan.md 已完成的执行计划文档

apps/aether-gateway/src/handlers/admin/provider/models/update.rs

@@ -1,10 +1,8 @@
 use super::payloads::build_admin_provider_model_response;
-use super::write::build_admin_provider_model_update_record;
-use crate::control::GatewayControlDecision;
-use crate::control::GatewayPublicRequestContext;
 use crate::handlers::admin::provider::shared::paths::admin_provider_model_route_parts;
 use crate::handlers::admin::provider::shared::payloads::AdminProviderModelUpdateRequest;
-use crate::{AppState, GatewayError};
+use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
+use crate::GatewayError;
 use axum::{
     body::{Body, Bytes},
     http,
@@ -15,18 +13,17 @@ use serde_json::json;
 use std::time::{SystemTime, UNIX_EPOCH};
 
 pub(super) async fn maybe_handle(
-    state: &AppState,
-    request_context: &GatewayPublicRequestContext,
+    state: &AdminAppState<'_>,
+    request_context: &AdminRequestContext<'_>,
     request_body: Option<&Bytes>,
-    decision: &GatewayControlDecision,
 ) -> Result<Option<Response<Body>>, GatewayError> {
-    if decision.route_family.as_deref() == Some("provider_models_manage")
-        && decision.route_kind.as_deref() == Some("update_provider_model")
-        && request_context.request_method == http::Method::PATCH
-        && request_context.request_path.contains("/models/")
+    if request_context.route_family() == Some("provider_models_manage")
+        && request_context.route_kind() == Some("update_provider_model")
+        && request_context.method() == http::Method::PATCH
+        && request_context.path().contains("/models/")
     {
         let Some((provider_id, model_id)) =
-            admin_provider_model_route_parts(&request_context.request_path)
+            admin_provider_model_route_parts(request_context.path())
         else {
             return Ok(Some(
                 (
@@ -90,21 +87,21 @@ pub(super) async fn maybe_handle(
                 ));
             }
         };
-        let record =
-            match build_admin_provider_model_update_record(state, &existing, &raw_payload, payload)
-                .await
-            {
-                Ok(record) => record,
-                Err(detail) => {
-                    return Ok(Some(
-                        (
-                            http::StatusCode::BAD_REQUEST,
-                            Json(json!({ "detail": detail })),
-                        )
-                            .into_response(),
-                    ));
-                }
-            };
+        let record = match state
+            .build_admin_provider_model_update_record(&existing, &raw_payload, payload)
+            .await
+        {
+            Ok(record) => record,
+            Err(detail) => {
+                return Ok(Some(
+                    (
+                        http::StatusCode::BAD_REQUEST,
+                        Json(json!({ "detail": detail })),
+                    )
+                        .into_response(),
+                ));
+            }
+        };
         return Ok(Some(
             match state.update_admin_provider_model(&record).await? {
                 Some(updated) => {