refactor: 大规模模块拆分与重组，新增 aether-admin crate

- 新建独立 aether-admin crate 承载 admin 相关共享契约与纯辅助函数
- 拆分 ai_pipeline 下 kiro/private_envelope/conversion/planner 等大文件为子模块目录
- 重组 admin handlers 各业务域（billing/oauth/provider/system/users 等）为目录结构，移除 shared.rs/builders.rs 等反模式
- 移除 ai_pipeline runtime adapters 旧实现（claude/openai/gemini/kiro/vertex/antigravity 等），改由 provider transport 统一承载
- 移除 control_facade/execution_facade/auth_snapshot_facade 等冗余 facade 层
- 拆分 query/billing 与 query/monitoring 模块、state/runtime/payments 与 security 模块
- 扩展架构测试覆盖 admin_billing/admin_model/admin_users 等新模块
- 删除 docs/architecture/refactor-execution-plan.md 已完成的执行计划文档

apps/aether-gateway/src/handlers/admin/provider/strategy/builders.rs

@@ -1,8 +1,9 @@
 use crate::handlers::admin::provider::shared::support::{
     normalize_provider_billing_type, parse_optional_rfc3339_unix_secs,
 };
+use crate::handlers::admin::request::AdminAppState;
 use crate::handlers::admin::shared::unix_secs_to_rfc3339;
-use crate::{AppState, GatewayError};
+use crate::GatewayError;
 use axum::{
     body::Body,
     http,
@@ -14,7 +15,7 @@ use serde_json::json;
 use std::time::{SystemTime, UNIX_EPOCH};
 
 #[derive(Debug, Deserialize)]
-pub(super) struct AdminProviderStrategyBillingRequest {
+pub(crate) struct AdminProviderStrategyBillingRequest {
     pub(super) billing_type: String,
     #[serde(default)]
     pub(super) monthly_quota_usd: Option<f64>,
@@ -38,7 +39,7 @@ fn default_provider_strategy_provider_priority() -> i32 {
     100
 }
 
-pub(super) fn build_provider_strategy_list_response() -> Response<Body> {
+pub(crate) fn build_provider_strategy_list_response() -> Response<Body> {
     Json(json!({
         "strategies": [{
             "name": "sticky_priority",
@@ -52,12 +53,13 @@ pub(super) fn build_provider_strategy_list_response() -> Response<Body> {
     .into_response()
 }
 
-pub(super) async fn build_provider_strategy_update_billing_response(
-    state: &AppState,
+pub(crate) async fn build_provider_strategy_update_billing_response(
+    state: &AdminAppState<'_>,
     provider_id: String,
     payload: AdminProviderStrategyBillingRequest,
 ) -> Result<Response<Body>, GatewayError> {
     let Some(existing) = state
+        .app()
         .read_provider_catalog_providers_by_ids(std::slice::from_ref(&provider_id))
         .await?
         .into_iter()
@@ -131,6 +133,7 @@ pub(super) async fn build_provider_strategy_update_billing_response(
     let synced_monthly_used_usd = match quota_last_reset_at_unix_secs {
         Some(quota_last_reset_at_unix_secs) if state.has_usage_data_reader() => Some(
             state
+                .app()
                 .summarize_provider_usage_since(&provider_id, quota_last_reset_at_unix_secs)
                 .await?
                 .total_cost_usd,
@@ -150,7 +153,11 @@ pub(super) async fn build_provider_strategy_update_billing_response(
             quota_expires_at_unix_secs,
         )
         .with_routing_fields(payload.provider_priority);
-    let Some(updated) = state.update_provider_catalog_provider(&updated).await? else {
+    let Some(updated) = state
+        .app()
+        .update_provider_catalog_provider(&updated)
+        .await?
+    else {
         return Ok(admin_provider_strategy_provider_not_found_response());
     };
 
@@ -166,8 +173,8 @@ pub(super) async fn build_provider_strategy_update_billing_response(
     .into_response())
 }
 
-pub(super) async fn build_provider_strategy_stats_response(
-    state: &AppState,
+pub(crate) async fn build_provider_strategy_stats_response(
+    state: &AdminAppState<'_>,
     provider_id: String,
     hours: u64,
 ) -> Result<Response<Body>, GatewayError> {
@@ -178,6 +185,7 @@ pub(super) async fn build_provider_strategy_stats_response(
     let since_unix_secs = now_unix_secs.saturating_sub(hours.saturating_mul(3600));
 
     let Some(provider) = state
+        .app()
         .read_provider_catalog_providers_by_ids(std::slice::from_ref(&provider_id))
         .await?
         .into_iter()
@@ -187,6 +195,7 @@ pub(super) async fn build_provider_strategy_stats_response(
     };
 
     let summary = state
+        .app()
         .summarize_provider_usage_since(&provider_id, since_unix_secs)
         .await?;
     let monthly_used_usd = provider.monthly_used_usd.unwrap_or(0.0);
@@ -222,11 +231,12 @@ pub(super) async fn build_provider_strategy_stats_response(
     .into_response())
 }
 
-pub(super) async fn build_provider_strategy_reset_quota_response(
-    state: &AppState,
+pub(crate) async fn build_provider_strategy_reset_quota_response(
+    state: &AdminAppState<'_>,
     provider_id: String,
 ) -> Result<Response<Body>, GatewayError> {
     let Some(provider) = state
+        .app()
         .read_provider_catalog_providers_by_ids(std::slice::from_ref(&provider_id))
         .await?
         .into_iter()
@@ -246,7 +256,11 @@ pub(super) async fn build_provider_strategy_reset_quota_response(
     let previous_used = provider.monthly_used_usd.unwrap_or(0.0);
     let mut updated = provider.clone();
     updated.monthly_used_usd = Some(0.0);
-    let Some(updated) = state.update_provider_catalog_provider(&updated).await? else {
+    let Some(updated) = state
+        .app()
+        .update_provider_catalog_provider(&updated)
+        .await?
+    else {
         return Ok(admin_provider_strategy_provider_not_found_response());
     };
 

apps/aether-gateway/src/handlers/admin/provider/strategy/mod.rs

@@ -1,15 +1,15 @@
-use crate::control::GatewayPublicRequestContext;
-use crate::{AppState, GatewayError};
+use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
+use crate::GatewayError;
 use axum::body::{Body, Bytes};
 use axum::http::Response;
 
-mod builders;
-mod responses;
+pub(crate) mod builders;
+pub(crate) mod responses;
 mod routes;
 
 pub(crate) async fn maybe_build_local_admin_provider_strategy_response(
-    state: &AppState,
-    request_context: &GatewayPublicRequestContext,
+    state: &AdminAppState<'_>,
+    request_context: &AdminRequestContext<'_>,
     request_body: Option<&Bytes>,
 ) -> Result<Option<Response<Body>>, GatewayError> {
     routes::maybe_build_local_admin_provider_strategy_response(state, request_context, request_body)

apps/aether-gateway/src/handlers/admin/provider/strategy/responses.rs

@@ -2,12 +2,12 @@ use crate::handlers::admin::shared::build_proxy_error_response;
 use axum::{body::Body, http, response::Response};
 use serde_json::json;
 
-pub(super) const ADMIN_PROVIDER_STRATEGY_DATA_UNAVAILABLE_DETAIL: &str =
+pub(crate) const ADMIN_PROVIDER_STRATEGY_DATA_UNAVAILABLE_DETAIL: &str =
     "Admin provider strategy data unavailable";
-pub(super) const ADMIN_PROVIDER_STRATEGY_STATS_DATA_UNAVAILABLE_DETAIL: &str =
+pub(crate) const ADMIN_PROVIDER_STRATEGY_STATS_DATA_UNAVAILABLE_DETAIL: &str =
     "Admin provider strategy stats data unavailable";
 
-pub(super) fn admin_provider_strategy_data_unavailable_response(detail: &str) -> Response<Body> {
+pub(crate) fn admin_provider_strategy_data_unavailable_response(detail: &str) -> Response<Body> {
     build_proxy_error_response(
         http::StatusCode::SERVICE_UNAVAILABLE,
         "data_unavailable",

apps/aether-gateway/src/handlers/admin/provider/strategy/routes.rs

@@ -1,150 +1,16 @@
-use super::builders::{
-    build_provider_strategy_list_response, build_provider_strategy_reset_quota_response,
-    build_provider_strategy_stats_response, build_provider_strategy_update_billing_response,
-    AdminProviderStrategyBillingRequest,
-};
-use super::responses::{
-    admin_provider_strategy_data_unavailable_response,
-    ADMIN_PROVIDER_STRATEGY_DATA_UNAVAILABLE_DETAIL,
-    ADMIN_PROVIDER_STRATEGY_STATS_DATA_UNAVAILABLE_DETAIL,
-};
-use crate::control::GatewayPublicRequestContext;
-use crate::handlers::admin::provider::shared::paths::{
-    admin_provider_id_for_provider_strategy_billing, admin_provider_id_for_provider_strategy_quota,
-    admin_provider_id_for_provider_strategy_stats, is_admin_provider_strategy_strategies_root,
-};
-use crate::handlers::admin::shared::query_param_value;
-use crate::{AppState, GatewayError};
+use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
+use crate::GatewayError;
 use axum::{
     body::{Body, Bytes},
-    http,
-    response::{IntoResponse, Response},
-    Json,
+    response::Response,
 };
-use serde_json::json;
 
 pub(super) async fn maybe_build_local_admin_provider_strategy_response(
-    state: &AppState,
-    request_context: &GatewayPublicRequestContext,
+    state: &AdminAppState<'_>,
+    request_context: &AdminRequestContext<'_>,
     request_body: Option<&Bytes>,
 ) -> Result<Option<Response<Body>>, GatewayError> {
-    let Some(decision) = request_context.control_decision.as_ref() else {
-        return Ok(None);
-    };
-    if decision.route_family.as_deref() != Some("provider_strategy_manage") {
-        return Ok(None);
-    }
-
-    if decision.route_kind.as_deref() == Some("list_strategies")
-        && request_context.request_method == http::Method::GET
-        && is_admin_provider_strategy_strategies_root(&request_context.request_path)
-    {
-        return Ok(Some(build_provider_strategy_list_response()));
-    }
-
-    if decision.route_kind.as_deref() == Some("update_provider_billing")
-        && request_context.request_method == http::Method::PUT
-    {
-        if !state.has_provider_catalog_data_reader() || !state.has_provider_catalog_data_writer() {
-            return Ok(Some(admin_provider_strategy_data_unavailable_response(
-                ADMIN_PROVIDER_STRATEGY_DATA_UNAVAILABLE_DETAIL,
-            )));
-        }
-
-        let Some(provider_id) =
-            admin_provider_id_for_provider_strategy_billing(&request_context.request_path)
-        else {
-            return Ok(Some(admin_provider_strategy_provider_not_found_response()));
-        };
-
-        let Some(request_body) = request_body else {
-            return Ok(Some(
-                (
-                    http::StatusCode::BAD_REQUEST,
-                    Json(json!({ "detail": "请求体不能为空" })),
-                )
-                    .into_response(),
-            ));
-        };
-        let payload =
-            match serde_json::from_slice::<AdminProviderStrategyBillingRequest>(request_body) {
-                Ok(payload) => payload,
-                Err(_) => {
-                    return Ok(Some(
-                        (
-                            http::StatusCode::BAD_REQUEST,
-                            Json(json!({ "detail": "请求数据验证失败" })),
-                        )
-                            .into_response(),
-                    ))
-                }
-            };
-
-        return Ok(Some(
-            build_provider_strategy_update_billing_response(state, provider_id, payload).await?,
-        ));
-    }
-
-    if decision.route_kind.as_deref() == Some("get_provider_stats")
-        && request_context.request_method == http::Method::GET
-    {
-        if !state.has_provider_catalog_data_reader() || !state.has_usage_data_reader() {
-            return Ok(Some(admin_provider_strategy_data_unavailable_response(
-                ADMIN_PROVIDER_STRATEGY_STATS_DATA_UNAVAILABLE_DETAIL,
-            )));
-        }
-
-        let Some(provider_id) =
-            admin_provider_id_for_provider_strategy_stats(&request_context.request_path)
-        else {
-            return Ok(Some(admin_provider_strategy_provider_not_found_response()));
-        };
-
-        let hours = query_param_value(request_context.request_query_string.as_deref(), "hours")
-            .and_then(|value| value.parse::<u64>().ok())
-            .filter(|value| *value > 0)
-            .unwrap_or(24);
-
-        return Ok(Some(
-            build_provider_strategy_stats_response(state, provider_id, hours).await?,
-        ));
-    }
-
-    if decision.route_kind.as_deref() == Some("reset_provider_quota")
-        && request_context.request_method == http::Method::DELETE
-    {
-        if !state.has_provider_catalog_data_reader() || !state.has_provider_catalog_data_writer() {
-            return Ok(Some(admin_provider_strategy_data_unavailable_response(
-                ADMIN_PROVIDER_STRATEGY_DATA_UNAVAILABLE_DETAIL,
-            )));
-        }
-
-        let Some(provider_id) =
-            admin_provider_id_for_provider_strategy_quota(&request_context.request_path)
-        else {
-            return Ok(Some(admin_provider_strategy_provider_not_found_response()));
-        };
-
-        return Ok(Some(
-            build_provider_strategy_reset_quota_response(state, provider_id).await?,
-        ));
-    }
-
-    Ok(Some(admin_provider_strategy_dispatcher_not_found_response()))
-}
-
-fn admin_provider_strategy_provider_not_found_response() -> Response<Body> {
-    (
-        http::StatusCode::NOT_FOUND,
-        Json(json!({ "detail": "Provider not found" })),
-    )
-        .into_response()
-}
-
-fn admin_provider_strategy_dispatcher_not_found_response() -> Response<Body> {
-    (
-        http::StatusCode::NOT_FOUND,
-        Json(json!({ "detail": "Provider strategy route not found" })),
-    )
-        .into_response()
+    state
+        .maybe_build_admin_provider_strategy_route_response(request_context, request_body)
+        .await
 }