refactor: 大规模模块拆分与重组，新增 aether-admin crate

- 新建独立 aether-admin crate 承载 admin 相关共享契约与纯辅助函数
- 拆分 ai_pipeline 下 kiro/private_envelope/conversion/planner 等大文件为子模块目录
- 重组 admin handlers 各业务域（billing/oauth/provider/system/users 等）为目录结构，移除 shared.rs/builders.rs 等反模式
- 移除 ai_pipeline runtime adapters 旧实现（claude/openai/gemini/kiro/vertex/antigravity 等），改由 provider transport 统一承载
- 移除 control_facade/execution_facade/auth_snapshot_facade 等冗余 facade 层
- 拆分 query/billing 与 query/monitoring 模块、state/runtime/payments 与 security 模块
- 扩展架构测试覆盖 admin_billing/admin_model/admin_users 等新模块
- 删除 docs/architecture/refactor-execution-plan.md 已完成的执行计划文档

apps/aether-gateway/src/handlers/public/support/user_me.rs

@@ -5,7 +5,7 @@ use super::{
     unix_secs_to_rfc3339, validate_auth_register_password, AppState, AuthenticatedLocalUserContext,
     GatewayPublicRequestContext, PUBLIC_CAPABILITY_DEFINITIONS,
 };
-use crate::handlers::admin::endpoint::build_admin_endpoint_health_status_payload;
+use crate::admin_api::build_admin_endpoint_health_status_payload;
 use crate::handlers::internal::build_management_token_payload;
 use crate::handlers::shared::{
     admin_stats_bad_request_response, list_usage_for_optional_range, parse_bounded_u32, round_to,

apps/aether-gateway/src/handlers/public/support/user_me_catalog.rs

@@ -402,7 +402,10 @@ pub(super) async fn handle_users_me_endpoint_status_get(
         Err(response) => return response,
     };
 
-    let Some(payload) = build_admin_endpoint_health_status_payload(state, 6).await else {
+    let Some(payload) =
+        build_admin_endpoint_health_status_payload(&crate::admin_api::AdminAppState::new(state), 6)
+            .await
+    else {
         return build_auth_error_response(
             http::StatusCode::SERVICE_UNAVAILABLE,
             USERS_ME_ENDPOINT_STATUS_UNAVAILABLE_DETAIL,

apps/aether-gateway/src/handlers/public/support/user_me_usage.rs

@@ -10,6 +10,8 @@ use axum::{
 use chrono::Utc;
 use serde_json::json;
 
+use crate::admin_api::AdminAppState;
+
 use super::{
     admin_stats_bad_request_response, build_auth_error_response, build_auth_wallet_summary_payload,
     list_usage_for_optional_range, parse_bounded_u32, query_param_value,
@@ -561,7 +563,7 @@ pub(super) async fn handle_users_me_usage_get(
     };
 
     let usage = match list_usage_for_optional_range(
-        state,
+        &AdminAppState::new(state),
         time_range.as_ref(),
         &AdminStatsUsageFilter {
             user_id: Some(auth.user.id.clone()),