refactor: 大规模模块拆分与重组，新增 aether-admin crate

- 新建独立 aether-admin crate 承载 admin 相关共享契约与纯辅助函数
- 拆分 ai_pipeline 下 kiro/private_envelope/conversion/planner 等大文件为子模块目录
- 重组 admin handlers 各业务域（billing/oauth/provider/system/users 等）为目录结构，移除 shared.rs/builders.rs 等反模式
- 移除 ai_pipeline runtime adapters 旧实现（claude/openai/gemini/kiro/vertex/antigravity 等），改由 provider transport 统一承载
- 移除 control_facade/execution_facade/auth_snapshot_facade 等冗余 facade 层
- 拆分 query/billing 与 query/monitoring 模块、state/runtime/payments 与 security 模块
- 扩展架构测试覆盖 admin_billing/admin_model/admin_users 等新模块
- 删除 docs/architecture/refactor-execution-plan.md 已完成的执行计划文档

apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/start.rs

@@ -1,14 +1,14 @@
-use super::super::refresh::build_internal_control_error_response;
+use super::super::errors::build_internal_control_error_response;
 use super::super::state::{
     admin_provider_oauth_template, build_provider_oauth_start_response,
     generate_provider_oauth_pkce_verifier, is_fixed_provider_type_for_provider_oauth,
-    provider_oauth_pkce_s256, save_provider_oauth_state,
+    provider_oauth_pkce_s256,
 };
-use crate::control::GatewayPublicRequestContext;
 use crate::handlers::admin::provider::shared::paths::{
     admin_provider_oauth_start_key_id, admin_provider_oauth_start_provider_id,
 };
-use crate::{AppState, GatewayError};
+use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
+use crate::GatewayError;
 use axum::{
     body::Body,
     http,
@@ -17,10 +17,10 @@ use axum::{
 };
 
 pub(super) async fn handle_admin_provider_oauth_start_key(
-    state: &AppState,
-    request_context: &GatewayPublicRequestContext,
+    state: &AdminAppState<'_>,
+    request_context: &AdminRequestContext<'_>,
 ) -> Result<Response<Body>, GatewayError> {
-    let Some(key_id) = admin_provider_oauth_start_key_id(&request_context.request_path) else {
+    let Some(key_id) = admin_provider_oauth_start_key_id(request_context.path()) else {
         return Ok(build_internal_control_error_response(
             http::StatusCode::NOT_FOUND,
             "Key 不存在",
@@ -74,14 +74,14 @@ pub(super) async fn handle_admin_provider_oauth_start_key(
         .use_pkce
         .then(generate_provider_oauth_pkce_verifier);
     let code_challenge = pkce_verifier.as_deref().map(provider_oauth_pkce_s256);
-    let nonce = match save_provider_oauth_state(
-        state,
-        &key_id,
-        &provider_id,
-        &provider_type,
-        pkce_verifier.as_deref(),
-    )
-    .await
+    let nonce = match state
+        .save_provider_oauth_state(
+            &key_id,
+            &provider_id,
+            &provider_type,
+            pkce_verifier.as_deref(),
+        )
+        .await
     {
         Ok(nonce) => nonce,
         Err(_) => {
@@ -101,11 +101,10 @@ pub(super) async fn handle_admin_provider_oauth_start_key(
 }
 
 pub(super) async fn handle_admin_provider_oauth_start_provider(
-    state: &AppState,
-    request_context: &GatewayPublicRequestContext,
+    state: &AdminAppState<'_>,
+    request_context: &AdminRequestContext<'_>,
 ) -> Result<Response<Body>, GatewayError> {
-    let Some(provider_id) = admin_provider_oauth_start_provider_id(&request_context.request_path)
-    else {
+    let Some(provider_id) = admin_provider_oauth_start_provider_id(request_context.path()) else {
         return Ok(build_internal_control_error_response(
             http::StatusCode::NOT_FOUND,
             "Provider 不存在",
@@ -146,14 +145,9 @@ pub(super) async fn handle_admin_provider_oauth_start_provider(
         .use_pkce
         .then(generate_provider_oauth_pkce_verifier);
     let code_challenge = pkce_verifier.as_deref().map(provider_oauth_pkce_s256);
-    let nonce = match save_provider_oauth_state(
-        state,
-        "",
-        &provider_id,
-        &provider_type,
-        pkce_verifier.as_deref(),
-    )
-    .await
+    let nonce = match state
+        .save_provider_oauth_state("", &provider_id, &provider_type, pkce_verifier.as_deref())
+        .await
     {
         Ok(nonce) => nonce,
         Err(_) => {