refactor: 大规模模块拆分与重组，新增 aether-admin crate

- 新建独立 aether-admin crate 承载 admin 相关共享契约与纯辅助函数
- 拆分 ai_pipeline 下 kiro/private_envelope/conversion/planner 等大文件为子模块目录
- 重组 admin handlers 各业务域（billing/oauth/provider/system/users 等）为目录结构，移除 shared.rs/builders.rs 等反模式
- 移除 ai_pipeline runtime adapters 旧实现（claude/openai/gemini/kiro/vertex/antigravity 等），改由 provider transport 统一承载
- 移除 control_facade/execution_facade/auth_snapshot_facade 等冗余 facade 层
- 拆分 query/billing 与 query/monitoring 模块、state/runtime/payments 与 security 模块
- 扩展架构测试覆盖 admin_billing/admin_model/admin_users 等新模块
- 删除 docs/architecture/refactor-execution-plan.md 已完成的执行计划文档

apps/aether-gateway/src/handlers/admin/provider/pool_admin/selection.rs

@@ -1,40 +1,20 @@
-use crate::handlers::admin::shared::decrypt_catalog_secret_with_fallbacks;
-use crate::AppState;
+use crate::handlers::admin::request::AdminAppState;
+use aether_admin::provider::pool as admin_provider_pool_pure;
 use aether_data_contracts::repository::provider_catalog::StoredProviderCatalogKey;
 
-fn admin_pool_reason_indicates_ban(reason: &str) -> bool {
-    let normalized = reason.trim().to_ascii_lowercase();
-    !normalized.is_empty()
-        && [
-            "banned",
-            "forbidden",
-            "blocked",
-            "suspend",
-            "deactivated",
-            "disabled",
-            "verification",
-            "workspace",
-            "受限",
-            "封",
-            "禁",
-        ]
-        .iter()
-        .any(|hint| normalized.contains(hint))
-}
-
 pub(super) fn admin_pool_normalize_text(value: impl AsRef<str>) -> String {
-    value.as_ref().trim().to_ascii_lowercase()
+    admin_provider_pool_pure::admin_pool_normalize_text(value)
 }
 
 fn admin_pool_parse_auth_config_json(
-    state: &AppState,
+    state: &AdminAppState<'_>,
     key: &StoredProviderCatalogKey,
 ) -> Option<serde_json::Map<String, serde_json::Value>> {
     let ciphertext = key.encrypted_auth_config.as_deref()?.trim();
     if ciphertext.is_empty() {
         return None;
     }
-    let plaintext = decrypt_catalog_secret_with_fallbacks(state.encryption_key(), ciphertext)?;
+    let plaintext = state.decrypt_catalog_secret_with_fallbacks(ciphertext)?;
     serde_json::from_str::<serde_json::Value>(&plaintext)
         .ok()?
         .as_object()
@@ -42,7 +22,7 @@ fn admin_pool_parse_auth_config_json(
 }
 
 fn admin_pool_derive_oauth_plan_type(
-    state: &AppState,
+    state: &AdminAppState<'_>,
     key: &StoredProviderCatalogKey,
     provider_type: &str,
 ) -> Option<String> {
@@ -106,141 +86,35 @@ fn admin_pool_derive_oauth_plan_type(
     None
 }
 
-fn admin_pool_has_proxy(key: &StoredProviderCatalogKey) -> bool {
-    match key.proxy.as_ref() {
-        Some(serde_json::Value::Object(values)) => !values.is_empty(),
-        Some(serde_json::Value::String(value)) => !value.trim().is_empty(),
-        Some(serde_json::Value::Bool(value)) => *value,
-        Some(serde_json::Value::Number(_)) => true,
-        Some(serde_json::Value::Array(values)) => !values.is_empty(),
-        _ => false,
-    }
-}
-
-fn admin_pool_is_oauth_invalid(key: &StoredProviderCatalogKey) -> bool {
-    if key.auth_type.trim() != "oauth" {
-        return false;
-    }
-    if key
-        .oauth_invalid_reason
-        .as_deref()
-        .is_some_and(|value| !value.trim().is_empty())
-    {
-        return true;
-    }
-    key.expires_at_unix_secs
-        .is_some_and(|value| value > 0 && value <= chrono::Utc::now().timestamp().max(0) as u64)
-}
-
 pub(super) fn admin_pool_matches_quick_selector(
-    state: &AppState,
+    state: &AdminAppState<'_>,
     key: &StoredProviderCatalogKey,
     provider_type: &str,
     selector: &str,
 ) -> bool {
-    match selector {
-        "banned" => admin_pool_key_is_known_banned(key),
-        "oauth_invalid" => admin_pool_is_oauth_invalid(key),
-        "proxy_unset" => !admin_pool_has_proxy(key),
-        "proxy_set" => admin_pool_has_proxy(key),
-        "disabled" => !key.is_active,
-        "enabled" => key.is_active,
-        "plan_free" => admin_pool_derive_oauth_plan_type(state, key, provider_type)
-            .is_some_and(|value| value.contains("free")),
-        "plan_team" => admin_pool_derive_oauth_plan_type(state, key, provider_type)
-            .is_some_and(|value| value.contains("team")),
-        "no_5h_limit" | "no_weekly_limit" => false,
-        _ => false,
-    }
+    let oauth_plan_type = admin_pool_derive_oauth_plan_type(state, key, provider_type);
+    admin_provider_pool_pure::admin_pool_matches_quick_selector(
+        key,
+        selector,
+        oauth_plan_type.as_deref(),
+        admin_provider_pool_pure::admin_pool_now_unix_secs(),
+    )
 }
 
 pub(super) fn admin_pool_matches_search(
-    state: &AppState,
+    state: &AdminAppState<'_>,
     key: &StoredProviderCatalogKey,
     provider_type: &str,
     search: Option<&str>,
 ) -> bool {
-    let Some(search) = search else {
-        return true;
-    };
-    let search = admin_pool_normalize_text(search);
-    if search.is_empty() {
-        return true;
-    }
-
     let oauth_plan_type = admin_pool_derive_oauth_plan_type(state, key, provider_type);
-    let mut search_fields = vec![
-        key.id.clone(),
-        key.name.clone(),
-        key.auth_type.clone(),
-        if key.is_active {
-            "已启用".to_string()
-        } else {
-            "已禁用".to_string()
-        },
-        if admin_pool_has_proxy(key) {
-            "独立代理".to_string()
-        } else {
-            "未配置代理".to_string()
-        },
-    ];
-    if let Some(reason) = key.oauth_invalid_reason.as_ref() {
-        search_fields.push(reason.clone());
-    }
-    if let Some(note) = key.note.as_ref() {
-        search_fields.push(note.clone());
-    }
-    if let Some(plan_type) = oauth_plan_type {
-        search_fields.push(plan_type);
-    }
-
-    search_fields
-        .into_iter()
-        .any(|value| admin_pool_normalize_text(&value).contains(&search))
+    admin_provider_pool_pure::admin_pool_matches_search(key, search, oauth_plan_type.as_deref())
 }
 
 pub(super) fn admin_pool_key_is_known_banned(key: &StoredProviderCatalogKey) -> bool {
-    if key
-        .oauth_invalid_reason
-        .as_deref()
-        .is_some_and(admin_pool_reason_indicates_ban)
-    {
-        return true;
-    }
-
-    let Some(account) = key
-        .status_snapshot
-        .as_ref()
-        .and_then(serde_json::Value::as_object)
-        .and_then(|snapshot| snapshot.get("account"))
-        .and_then(serde_json::Value::as_object)
-    else {
-        return false;
-    };
-
-    if !account
-        .get("blocked")
-        .and_then(serde_json::Value::as_bool)
-        .unwrap_or(false)
-    {
-        return false;
-    }
-
-    account
-        .get("code")
-        .and_then(serde_json::Value::as_str)
-        .is_some_and(admin_pool_reason_indicates_ban)
-        || account
-            .get("reason")
-            .and_then(serde_json::Value::as_str)
-            .is_some_and(admin_pool_reason_indicates_ban)
+    admin_provider_pool_pure::admin_pool_key_is_known_banned(key)
 }
 
 pub(super) fn admin_pool_sort_keys(keys: &mut [StoredProviderCatalogKey]) {
-    keys.sort_by(|left, right| {
-        left.internal_priority
-            .cmp(&right.internal_priority)
-            .then(left.name.cmp(&right.name))
-            .then(left.id.cmp(&right.id))
-    });
+    admin_provider_pool_pure::admin_pool_sort_keys(keys);
 }