refactor: 大规模模块拆分与重组，新增 aether-admin crate

- 新建独立 aether-admin crate 承载 admin 相关共享契约与纯辅助函数
- 拆分 ai_pipeline 下 kiro/private_envelope/conversion/planner 等大文件为子模块目录
- 重组 admin handlers 各业务域（billing/oauth/provider/system/users 等）为目录结构，移除 shared.rs/builders.rs 等反模式
- 移除 ai_pipeline runtime adapters 旧实现（claude/openai/gemini/kiro/vertex/antigravity 等），改由 provider transport 统一承载
- 移除 control_facade/execution_facade/auth_snapshot_facade 等冗余 facade 层
- 拆分 query/billing 与 query/monitoring 模块、state/runtime/payments 与 security 模块
- 扩展架构测试覆盖 admin_billing/admin_model/admin_users 等新模块
- 删除 docs/architecture/refactor-execution-plan.md 已完成的执行计划文档

apps/aether-gateway/src/handlers/internal/gateway.rs

@@ -8,9 +8,7 @@ use super::{
     maybe_build_internal_finalize_video_response, parse_internal_tunnel_heartbeat_request,
     parse_internal_tunnel_node_status_request,
 };
-use crate::ai_pipeline::finalize::maybe_build_sync_finalize_outcome;
-use crate::ai_pipeline::planner as ai_planner;
-use crate::ai_pipeline::planner::{maybe_build_stream_plan_payload, maybe_build_sync_plan_payload};
+use crate::ai_pipeline_api;
 use crate::constants::{
     CONTROL_EXECUTED_HEADER, EXECUTION_PATH_EXECUTION_RUNTIME_STREAM,
     EXECUTION_PATH_EXECUTION_RUNTIME_SYNC,
@@ -230,7 +228,7 @@ pub(crate) async fn maybe_build_local_internal_proxy_response_impl(
                         .into_response(),
                     ));
                 }
-                let Some(mut local_payload) = ai_planner::maybe_build_sync_decision_payload(
+                let Some(mut local_payload) = ai_pipeline_api::maybe_build_sync_decision_payload(
                     state,
                     &parts,
                     trace_id.as_str(),
@@ -332,7 +330,7 @@ pub(crate) async fn maybe_build_local_internal_proxy_response_impl(
                         .into_response(),
                     ));
                 }
-                let Some(mut local_payload) = ai_planner::maybe_build_stream_decision_payload(
+                let Some(mut local_payload) = ai_pipeline_api::maybe_build_stream_decision_payload(
                     state,
                     &parts,
                     trace_id.as_str(),
@@ -412,7 +410,7 @@ pub(crate) async fn maybe_build_local_internal_proxy_response_impl(
                     resolved.auth_context = Some(auth_context);
                     resolved.local_auth_rejection = None;
                 }
-                if let Some(mut planned) = maybe_build_sync_plan_payload(
+                if let Some(mut planned) = ai_pipeline_api::maybe_build_sync_plan_payload(
                     state,
                     &parts,
                     trace_id.as_str(),
@@ -478,7 +476,7 @@ pub(crate) async fn maybe_build_local_internal_proxy_response_impl(
                     resolved.auth_context = Some(auth_context);
                     resolved.local_auth_rejection = None;
                 }
-                if let Some(mut planned) = maybe_build_stream_plan_payload(
+                if let Some(mut planned) = ai_pipeline_api::maybe_build_stream_plan_payload(
                     state,
                     &parts,
                     trace_id.as_str(),
@@ -548,7 +546,7 @@ pub(crate) async fn maybe_build_local_internal_proxy_response_impl(
                     resolved.auth_context = Some(auth_context);
                     resolved.local_auth_rejection = None;
                 }
-                if let Some(plan_payload) = maybe_build_sync_plan_payload(
+                if let Some(plan_payload) = ai_pipeline_api::maybe_build_sync_plan_payload(
                     state,
                     &parts,
                     trace_id.as_str(),
@@ -632,7 +630,7 @@ pub(crate) async fn maybe_build_local_internal_proxy_response_impl(
                     resolved.auth_context = Some(auth_context);
                     resolved.local_auth_rejection = None;
                 }
-                if let Some(plan_payload) = maybe_build_stream_plan_payload(
+                if let Some(plan_payload) = ai_pipeline_api::maybe_build_stream_plan_payload(
                     state,
                     &parts,
                     trace_id.as_str(),
@@ -740,9 +738,11 @@ pub(crate) async fn maybe_build_local_internal_proxy_response_impl(
                     )));
                 };
                 let trace_id = payload.trace_id.clone();
-                if let Some(outcome) =
-                    maybe_build_sync_finalize_outcome(&trace_id, &synthetic_decision, &payload)?
-                {
+                if let Some(outcome) = ai_pipeline_api::maybe_build_sync_finalize_outcome(
+                    &trace_id,
+                    &synthetic_decision,
+                    &payload,
+                )? {
                     if let Some(background_report) = outcome.background_report {
                         crate::usage::spawn_sync_report(
                             state.clone(),

apps/aether-gateway/src/handlers/internal/gateway_helpers.rs

@@ -1,3 +1,4 @@
+use crate::admin_api::build_internal_control_error_response;
 use crate::constants::{
     CONTROL_ACTION_HEADER, CONTROL_ACTION_PROXY_PUBLIC, CONTROL_EXECUTED_HEADER,
     CONTROL_EXECUTION_RUNTIME_CANDIDATE_KEY, EXECUTION_PATH_CONTROL_EXECUTE_STREAM,
@@ -12,7 +13,6 @@ use crate::execution_runtime::{
     maybe_build_local_video_success_outcome, resolve_local_sync_error_background_report_kind,
     resolve_local_sync_success_background_report_kind,
 };
-use crate::handlers::admin::provider::oauth::refresh::build_internal_control_error_response;
 use crate::handlers::shared::{
     unix_secs_to_rfc3339, InternalTunnelHeartbeatRequest, InternalTunnelNodeStatusRequest,
 };

apps/aether-gateway/src/handlers/internal/mod.rs

@@ -1,4 +1,4 @@
-use super::admin::provider::oauth::refresh::build_internal_control_error_response;
+use crate::admin_api::build_internal_control_error_response;
 
 mod gateway_helpers;
 use self::gateway_helpers::*;