refactor: 大规模模块拆分与重组，新增 aether-admin crate

- 新建独立 aether-admin crate 承载 admin 相关共享契约与纯辅助函数
- 拆分 ai_pipeline 下 kiro/private_envelope/conversion/planner 等大文件为子模块目录
- 重组 admin handlers 各业务域（billing/oauth/provider/system/users 等）为目录结构，移除 shared.rs/builders.rs 等反模式
- 移除 ai_pipeline runtime adapters 旧实现（claude/openai/gemini/kiro/vertex/antigravity 等），改由 provider transport 统一承载
- 移除 control_facade/execution_facade/auth_snapshot_facade 等冗余 facade 层
- 拆分 query/billing 与 query/monitoring 模块、state/runtime/payments 与 security 模块
- 扩展架构测试覆盖 admin_billing/admin_model/admin_users 等新模块
- 删除 docs/architecture/refactor-execution-plan.md 已完成的执行计划文档

apps/aether-gateway/src/tests/architecture/sql_and_data.rs

@@ -200,11 +200,14 @@ fn gateway_auth_data_layer_does_not_keep_ldap_row_wrapper() {
 
 #[test]
 fn gateway_provider_oauth_storage_types_are_owned_by_aether_data() {
-    let provider_oauth_state =
-        read_workspace_file("apps/aether-gateway/src/handlers/admin/provider/oauth/state.rs");
+    let provider_oauth_storage = read_workspace_file(
+        "apps/aether-gateway/src/handlers/admin/provider/oauth/state/storage.rs",
+    );
+    let request_provider_oauth =
+        read_workspace_file("apps/aether-gateway/src/handlers/admin/request/provider/oauth.rs");
     assert!(
-        provider_oauth_state.contains("aether_data::repository::provider_oauth"),
-        "provider_oauth/state.rs should depend on aether-data provider oauth storage types"
+        request_provider_oauth.contains("aether_data::repository::provider_oauth"),
+        "request/provider/oauth.rs should depend on aether-data provider oauth storage types"
     );
     for pattern in [
         "pub(crate) struct StoredAdminProviderOAuthDeviceSession",
@@ -217,17 +220,38 @@ fn gateway_provider_oauth_storage_types_are_owned_by_aether_data() {
         "format!(\"provider_oauth_state:{nonce}\")",
     ] {
         assert!(
-            !provider_oauth_state.contains(pattern),
-            "provider_oauth/state.rs should not own local storage helper {pattern}"
+            !provider_oauth_storage.contains(pattern),
+            "provider_oauth/state/storage.rs should not own local storage helper {pattern}"
+        );
+    }
+    for pattern in [
+        "StoredAdminProviderOAuthDeviceSession",
+        "StoredAdminProviderOAuthState",
+        "provider_oauth_batch_task_storage_key",
+        "build_provider_oauth_batch_task_status_payload",
+        "PROVIDER_OAUTH_BATCH_TASK_TTL_SECS",
+    ] {
+        assert!(
+            request_provider_oauth.contains(pattern),
+            "request/provider/oauth.rs should own aether-data provider oauth storage boundary {pattern}"
         );
     }
 
-    let dispatch_device = read_workspace_file(
-        "apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/device.rs",
+    assert!(
+        !workspace_file_exists("apps/aether-gateway/src/handlers/admin/provider/oauth/state.rs"),
+        "provider_oauth/state.rs should not exist after oauth storage helpers move under state/storage.rs"
+    );
+
+    let dispatch_device_authorize = read_workspace_file(
+        "apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/device/authorize.rs",
     );
     assert!(
-        dispatch_device.contains("aether_data::repository::provider_oauth"),
-        "provider_oauth/dispatch/device.rs should use shared provider oauth storage DTOs"
+        dispatch_device_authorize.contains("aether_data::repository::provider_oauth"),
+        "provider_oauth/dispatch/device/authorize.rs should use shared provider oauth storage DTOs"
+    );
+    assert!(
+        !workspace_file_exists("apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/device.rs"),
+        "provider_oauth/dispatch/device.rs should be removed once device flows move under dispatch/device/"
     );
 
     let shared_provider_oauth =