refactor: 大规模模块拆分与重组，新增 aether-admin crate

- 新建独立 aether-admin crate 承载 admin 相关共享契约与纯辅助函数
- 拆分 ai_pipeline 下 kiro/private_envelope/conversion/planner 等大文件为子模块目录
- 重组 admin handlers 各业务域（billing/oauth/provider/system/users 等）为目录结构，移除 shared.rs/builders.rs 等反模式
- 移除 ai_pipeline runtime adapters 旧实现（claude/openai/gemini/kiro/vertex/antigravity 等），改由 provider transport 统一承载
- 移除 control_facade/execution_facade/auth_snapshot_facade 等冗余 facade 层
- 拆分 query/billing 与 query/monitoring 模块、state/runtime/payments 与 security 模块
- 扩展架构测试覆盖 admin_billing/admin_model/admin_users 等新模块
- 删除 docs/architecture/refactor-execution-plan.md 已完成的执行计划文档

apps/aether-gateway/src/handlers/admin/provider/shared/paths/crud.rs

@@ -0,0 +1,124 @@
+pub(crate) fn admin_provider_id_for_health_monitor(request_path: &str) -> Option<String> {
+    admin_provider_id_for_suffix(request_path, "/health-monitor")
+}
+
+pub(crate) fn admin_provider_id_for_mapping_preview(request_path: &str) -> Option<String> {
+    admin_provider_id_for_suffix(request_path, "/mapping-preview")
+}
+
+pub(crate) fn admin_provider_id_for_pool_status(request_path: &str) -> Option<String> {
+    admin_provider_id_for_suffix(request_path, "/pool-status")
+}
+
+pub(crate) fn admin_provider_clear_pool_cooldown_parts(
+    request_path: &str,
+) -> Option<(String, String)> {
+    admin_provider_pool_key_route_parts(request_path, "/pool/clear-cooldown/")
+}
+
+pub(crate) fn admin_provider_reset_pool_cost_parts(request_path: &str) -> Option<(String, String)> {
+    admin_provider_pool_key_route_parts(request_path, "/pool/reset-cost/")
+}
+
+pub(crate) fn admin_provider_delete_task_parts(request_path: &str) -> Option<(String, String)> {
+    let raw = request_path.strip_prefix("/api/admin/providers/")?;
+    let (provider_id, task_id) = raw.split_once("/delete-task/")?;
+    let provider_id = provider_id.trim().trim_matches('/');
+    let task_id = task_id.trim().trim_matches('/');
+    if provider_id.is_empty()
+        || task_id.is_empty()
+        || provider_id.contains('/')
+        || task_id.contains('/')
+    {
+        None
+    } else {
+        Some((provider_id.to_string(), task_id.to_string()))
+    }
+}
+
+pub(crate) fn admin_provider_id_for_summary(request_path: &str) -> Option<String> {
+    admin_provider_id_for_suffix(request_path, "/summary")
+}
+
+pub(crate) fn admin_provider_id_for_manage_path(request_path: &str) -> Option<String> {
+    let raw = request_path.strip_prefix("/api/admin/providers/")?;
+    let normalized = raw.trim().trim_matches('/');
+    if normalized.is_empty() || normalized.contains('/') {
+        None
+    } else {
+        Some(normalized.to_string())
+    }
+}
+
+pub(crate) fn is_admin_providers_root(request_path: &str) -> bool {
+    matches!(
+        request_path,
+        "/api/admin/providers" | "/api/admin/providers/"
+    )
+}
+
+pub(crate) fn admin_provider_id_for_models_list(request_path: &str) -> Option<String> {
+    admin_provider_id_for_suffix(request_path, "/models")
+}
+
+pub(crate) fn admin_provider_model_route_parts(request_path: &str) -> Option<(String, String)> {
+    let raw = request_path.strip_prefix("/api/admin/providers/")?;
+    let (provider_id, model_id) = raw.split_once("/models/")?;
+    let provider_id = provider_id.trim().trim_matches('/');
+    let model_id = model_id.trim().trim_matches('/');
+    if provider_id.is_empty()
+        || model_id.is_empty()
+        || provider_id.contains('/')
+        || model_id.contains('/')
+    {
+        None
+    } else {
+        Some((provider_id.to_string(), model_id.to_string()))
+    }
+}
+
+pub(crate) fn admin_provider_models_batch_path(request_path: &str) -> Option<String> {
+    admin_provider_id_for_suffix(request_path, "/models/batch")
+}
+
+pub(crate) fn admin_provider_available_source_models_path(request_path: &str) -> Option<String> {
+    admin_provider_id_for_suffix(request_path, "/available-source-models")
+}
+
+pub(crate) fn admin_provider_assign_global_models_path(request_path: &str) -> Option<String> {
+    admin_provider_id_for_suffix(request_path, "/assign-global-models")
+}
+
+pub(crate) fn admin_provider_import_models_path(request_path: &str) -> Option<String> {
+    admin_provider_id_for_suffix(request_path, "/import-from-upstream")
+}
+
+fn admin_provider_id_for_suffix(request_path: &str, suffix: &str) -> Option<String> {
+    let raw = request_path.strip_prefix("/api/admin/providers/")?;
+    let raw = raw.strip_suffix(suffix)?;
+    let normalized = raw.trim().trim_matches('/');
+    if normalized.is_empty() || normalized.contains('/') {
+        None
+    } else {
+        Some(normalized.to_string())
+    }
+}
+
+fn admin_provider_pool_key_route_parts(
+    request_path: &str,
+    marker: &str,
+) -> Option<(String, String)> {
+    let raw = request_path.strip_prefix("/api/admin/providers/")?;
+    let (provider_id, key_id) = raw.split_once(marker)?;
+    let provider_id = provider_id.trim().trim_matches('/');
+    let key_id = key_id.trim().trim_matches('/');
+    if provider_id.is_empty()
+        || key_id.is_empty()
+        || provider_id.contains('/')
+        || key_id.contains('/')
+    {
+        None
+    } else {
+        Some((provider_id.to_string(), key_id.to_string()))
+    }
+}

apps/aether-gateway/src/handlers/admin/provider/shared/paths/endpoint_keys.rs

@@ -0,0 +1,39 @@
+pub(crate) fn admin_provider_id_for_keys(request_path: &str) -> Option<String> {
+    request_path
+        .strip_prefix("/api/admin/endpoints/providers/")?
+        .strip_suffix("/keys")
+        .map(ToOwned::to_owned)
+}
+
+pub(crate) fn admin_provider_id_for_refresh_quota(request_path: &str) -> Option<String> {
+    request_path
+        .strip_prefix("/api/admin/endpoints/providers/")?
+        .strip_suffix("/refresh-quota")
+        .map(ToOwned::to_owned)
+}
+
+pub(crate) fn admin_reveal_key_id(request_path: &str) -> Option<String> {
+    request_path
+        .strip_prefix("/api/admin/endpoints/keys/")?
+        .strip_suffix("/reveal")
+        .map(ToOwned::to_owned)
+}
+
+pub(crate) fn admin_export_key_id(request_path: &str) -> Option<String> {
+    request_path
+        .strip_prefix("/api/admin/endpoints/keys/")?
+        .strip_suffix("/export")
+        .map(ToOwned::to_owned)
+}
+
+pub(crate) fn admin_clear_oauth_invalid_key_id(request_path: &str) -> Option<String> {
+    request_path
+        .strip_prefix("/api/admin/endpoints/keys/")?
+        .strip_suffix("/clear-oauth-invalid")
+        .map(ToOwned::to_owned)
+}
+
+pub(crate) fn admin_update_key_id(request_path: &str) -> Option<String> {
+    let key_id = request_path.strip_prefix("/api/admin/endpoints/keys/")?;
+    (!key_id.is_empty() && !key_id.contains('/')).then_some(key_id.to_string())
+}

apps/aether-gateway/src/handlers/admin/provider/shared/paths/mod.rs

@@ -0,0 +1,40 @@
+mod crud;
+mod endpoint_keys;
+mod oauth;
+mod ops;
+mod strategy;
+
+pub(crate) use self::crud::{
+    admin_provider_assign_global_models_path, admin_provider_available_source_models_path,
+    admin_provider_clear_pool_cooldown_parts, admin_provider_delete_task_parts,
+    admin_provider_id_for_health_monitor, admin_provider_id_for_manage_path,
+    admin_provider_id_for_mapping_preview, admin_provider_id_for_models_list,
+    admin_provider_id_for_pool_status, admin_provider_id_for_summary,
+    admin_provider_import_models_path, admin_provider_model_route_parts,
+    admin_provider_models_batch_path, admin_provider_reset_pool_cost_parts,
+    is_admin_providers_root,
+};
+pub(crate) use self::endpoint_keys::{
+    admin_clear_oauth_invalid_key_id, admin_export_key_id, admin_provider_id_for_keys,
+    admin_provider_id_for_refresh_quota, admin_reveal_key_id, admin_update_key_id,
+};
+pub(crate) use self::oauth::{
+    admin_provider_oauth_batch_import_provider_id, admin_provider_oauth_batch_import_task_path,
+    admin_provider_oauth_batch_import_task_provider_id, admin_provider_oauth_complete_key_id,
+    admin_provider_oauth_complete_provider_id, admin_provider_oauth_device_authorize_provider_id,
+    admin_provider_oauth_device_poll_provider_id, admin_provider_oauth_import_provider_id,
+    admin_provider_oauth_refresh_key_id, admin_provider_oauth_start_key_id,
+    admin_provider_oauth_start_provider_id,
+};
+pub(crate) use self::ops::{
+    admin_provider_id_for_provider_ops_balance, admin_provider_id_for_provider_ops_checkin,
+    admin_provider_id_for_provider_ops_config, admin_provider_id_for_provider_ops_connect,
+    admin_provider_id_for_provider_ops_disconnect, admin_provider_id_for_provider_ops_status,
+    admin_provider_id_for_provider_ops_verify, admin_provider_ops_action_route_parts,
+    admin_provider_ops_architecture_id_from_path, is_admin_provider_ops_architectures_root,
+    is_admin_provider_ops_batch_balance_root,
+};
+pub(crate) use self::strategy::{
+    admin_provider_id_for_provider_strategy_billing, admin_provider_id_for_provider_strategy_quota,
+    admin_provider_id_for_provider_strategy_stats, is_admin_provider_strategy_strategies_root,
+};

apps/aether-gateway/src/handlers/admin/provider/shared/paths/oauth.rs

@@ -0,0 +1,81 @@
+pub(crate) fn admin_provider_oauth_start_key_id(request_path: &str) -> Option<String> {
+    request_path
+        .strip_prefix("/api/admin/provider-oauth/keys/")?
+        .strip_suffix("/start")
+        .filter(|key_id| !key_id.is_empty() && !key_id.contains('/'))
+        .map(ToOwned::to_owned)
+}
+
+pub(crate) fn admin_provider_oauth_start_provider_id(request_path: &str) -> Option<String> {
+    provider_oauth_provider_id_for_suffix(request_path, "/start")
+}
+
+pub(crate) fn admin_provider_oauth_complete_key_id(request_path: &str) -> Option<String> {
+    request_path
+        .strip_prefix("/api/admin/provider-oauth/keys/")?
+        .strip_suffix("/complete")
+        .filter(|key_id| !key_id.is_empty() && !key_id.contains('/'))
+        .map(ToOwned::to_owned)
+}
+
+pub(crate) fn admin_provider_oauth_refresh_key_id(request_path: &str) -> Option<String> {
+    request_path
+        .strip_prefix("/api/admin/provider-oauth/keys/")?
+        .strip_suffix("/refresh")
+        .filter(|key_id| !key_id.is_empty() && !key_id.contains('/'))
+        .map(ToOwned::to_owned)
+}
+
+pub(crate) fn admin_provider_oauth_complete_provider_id(request_path: &str) -> Option<String> {
+    provider_oauth_provider_id_for_suffix(request_path, "/complete")
+}
+
+pub(crate) fn admin_provider_oauth_import_provider_id(request_path: &str) -> Option<String> {
+    provider_oauth_provider_id_for_suffix(request_path, "/import-refresh-token")
+}
+
+pub(crate) fn admin_provider_oauth_batch_import_provider_id(request_path: &str) -> Option<String> {
+    provider_oauth_provider_id_for_suffix(request_path, "/batch-import")
+}
+
+pub(crate) fn admin_provider_oauth_batch_import_task_provider_id(
+    request_path: &str,
+) -> Option<String> {
+    provider_oauth_provider_id_for_suffix(request_path, "/batch-import/tasks")
+}
+
+pub(crate) fn admin_provider_oauth_batch_import_task_path(
+    request_path: &str,
+) -> Option<(String, String)> {
+    let suffix = request_path
+        .strip_prefix("/api/admin/provider-oauth/providers/")?
+        .strip_suffix("/")
+        .unwrap_or(request_path.strip_prefix("/api/admin/provider-oauth/providers/")?);
+    let (provider_id, task_path) = suffix.split_once("/batch-import/tasks/")?;
+    if provider_id.is_empty()
+        || provider_id.contains('/')
+        || task_path.is_empty()
+        || task_path.contains('/')
+    {
+        return None;
+    }
+    Some((provider_id.to_string(), task_path.to_string()))
+}
+
+pub(crate) fn admin_provider_oauth_device_authorize_provider_id(
+    request_path: &str,
+) -> Option<String> {
+    provider_oauth_provider_id_for_suffix(request_path, "/device-authorize")
+}
+
+pub(crate) fn admin_provider_oauth_device_poll_provider_id(request_path: &str) -> Option<String> {
+    provider_oauth_provider_id_for_suffix(request_path, "/device-poll")
+}
+
+fn provider_oauth_provider_id_for_suffix(request_path: &str, suffix: &str) -> Option<String> {
+    request_path
+        .strip_prefix("/api/admin/provider-oauth/providers/")?
+        .strip_suffix(suffix)
+        .filter(|provider_id| !provider_id.is_empty() && !provider_id.contains('/'))
+        .map(ToOwned::to_owned)
+}

apps/aether-gateway/src/handlers/admin/provider/shared/paths/ops.rs

@@ -0,0 +1,77 @@
+pub(crate) fn is_admin_provider_ops_architectures_root(request_path: &str) -> bool {
+    matches!(
+        request_path,
+        "/api/admin/provider-ops/architectures" | "/api/admin/provider-ops/architectures/"
+    )
+}
+
+pub(crate) fn admin_provider_ops_architecture_id_from_path(request_path: &str) -> Option<String> {
+    let raw = request_path.strip_prefix("/api/admin/provider-ops/architectures/")?;
+    let normalized = raw.trim().trim_matches('/');
+    if normalized.is_empty() || normalized.contains('/') {
+        None
+    } else {
+        Some(normalized.to_string())
+    }
+}
+
+pub(crate) fn admin_provider_id_for_provider_ops_status(request_path: &str) -> Option<String> {
+    provider_ops_provider_id_for_suffix(request_path, "/status")
+}
+
+pub(crate) fn admin_provider_id_for_provider_ops_config(request_path: &str) -> Option<String> {
+    provider_ops_provider_id_for_suffix(request_path, "/config")
+}
+
+pub(crate) fn admin_provider_id_for_provider_ops_disconnect(request_path: &str) -> Option<String> {
+    provider_ops_provider_id_for_suffix(request_path, "/disconnect")
+}
+
+pub(crate) fn admin_provider_id_for_provider_ops_connect(request_path: &str) -> Option<String> {
+    provider_ops_provider_id_for_suffix(request_path, "/connect")
+}
+
+pub(crate) fn admin_provider_id_for_provider_ops_verify(request_path: &str) -> Option<String> {
+    provider_ops_provider_id_for_suffix(request_path, "/verify")
+}
+
+pub(crate) fn admin_provider_id_for_provider_ops_balance(request_path: &str) -> Option<String> {
+    provider_ops_provider_id_for_suffix(request_path, "/balance")
+}
+
+pub(crate) fn admin_provider_id_for_provider_ops_checkin(request_path: &str) -> Option<String> {
+    provider_ops_provider_id_for_suffix(request_path, "/checkin")
+}
+
+pub(crate) fn admin_provider_ops_action_route_parts(
+    request_path: &str,
+) -> Option<(String, String)> {
+    let raw = request_path.strip_prefix("/api/admin/provider-ops/providers/")?;
+    let (provider_id, action_type) = raw.split_once("/actions/")?;
+    let provider_id = provider_id.trim().trim_matches('/');
+    let action_type = action_type.trim().trim_matches('/');
+    if provider_id.is_empty()
+        || action_type.is_empty()
+        || provider_id.contains('/')
+        || action_type.contains('/')
+    {
+        None
+    } else {
+        Some((provider_id.to_string(), action_type.to_string()))
+    }
+}
+
+pub(crate) fn is_admin_provider_ops_batch_balance_root(request_path: &str) -> bool {
+    matches!(
+        request_path,
+        "/api/admin/provider-ops/batch/balance" | "/api/admin/provider-ops/batch/balance/"
+    )
+}
+
+fn provider_ops_provider_id_for_suffix(request_path: &str, suffix: &str) -> Option<String> {
+    request_path
+        .strip_prefix("/api/admin/provider-ops/providers/")?
+        .strip_suffix(suffix)
+        .map(|value| value.trim().trim_matches('/').to_string())
+        .filter(|value| !value.is_empty() && !value.contains('/'))
+}

apps/aether-gateway/src/handlers/admin/provider/shared/paths/strategy.rs

@@ -0,0 +1,28 @@
+pub(crate) fn is_admin_provider_strategy_strategies_root(request_path: &str) -> bool {
+    matches!(
+        request_path,
+        "/api/admin/provider-strategy/strategies" | "/api/admin/provider-strategy/strategies/"
+    )
+}
+
+pub(crate) fn admin_provider_id_for_provider_strategy_billing(
+    request_path: &str,
+) -> Option<String> {
+    strategy_provider_id_for_suffix(request_path, "/billing")
+}
+
+pub(crate) fn admin_provider_id_for_provider_strategy_stats(request_path: &str) -> Option<String> {
+    strategy_provider_id_for_suffix(request_path, "/stats")
+}
+
+pub(crate) fn admin_provider_id_for_provider_strategy_quota(request_path: &str) -> Option<String> {
+    strategy_provider_id_for_suffix(request_path, "/quota")
+}
+
+fn strategy_provider_id_for_suffix(request_path: &str, suffix: &str) -> Option<String> {
+    request_path
+        .strip_prefix("/api/admin/provider-strategy/providers/")?
+        .strip_suffix(suffix)
+        .map(|value| value.trim().trim_matches('/').to_string())
+        .filter(|value| !value.is_empty() && !value.contains('/'))
+}