refactor: 大规模模块拆分与重组，新增 aether-admin crate

- 新建独立 aether-admin crate 承载 admin 相关共享契约与纯辅助函数
- 拆分 ai_pipeline 下 kiro/private_envelope/conversion/planner 等大文件为子模块目录
- 重组 admin handlers 各业务域（billing/oauth/provider/system/users 等）为目录结构，移除 shared.rs/builders.rs 等反模式
- 移除 ai_pipeline runtime adapters 旧实现（claude/openai/gemini/kiro/vertex/antigravity 等），改由 provider transport 统一承载
- 移除 control_facade/execution_facade/auth_snapshot_facade 等冗余 facade 层
- 拆分 query/billing 与 query/monitoring 模块、state/runtime/payments 与 security 模块
- 扩展架构测试覆盖 admin_billing/admin_model/admin_users 等新模块
- 删除 docs/architecture/refactor-execution-plan.md 已完成的执行计划文档

apps/aether-gateway/src/tests/control/admin/oauth.rs

@@ -22,6 +22,9 @@ use super::super::{
     build_router_with_state, sample_endpoint, sample_key, sample_management_token,
     sample_oauth_provider_config, sample_provider, start_server, AppState,
 };
+use crate::admin_api::{
+    maybe_build_local_admin_provider_oauth_response, AdminAppState, AdminRequestContext,
+};
 use crate::audit::AdminAuditEvent;
 use crate::constants::{
     GATEWAY_HEADER, TRUSTED_ADMIN_MANAGEMENT_TOKEN_ID_HEADER, TRUSTED_ADMIN_SESSION_ID_HEADER,
@@ -29,7 +32,6 @@ use crate::constants::{
 };
 use crate::control::resolve_public_request_context;
 use crate::data::GatewayDataState;
-use crate::handlers::admin::provider::maybe_build_local_admin_provider_oauth_response;
 
 fn trusted_admin_headers() -> HeaderMap {
     let mut headers = HeaderMap::new();
@@ -70,10 +72,14 @@ async fn local_admin_provider_oauth_response(
     .await
     .expect("request context should resolve");
     let body_bytes = body.map(|value| Bytes::from(value.to_string()));
-    maybe_build_local_admin_provider_oauth_response(state, &request_context, body_bytes.as_ref())
-        .await
-        .expect("local provider oauth response should build")
-        .expect("provider oauth route should resolve locally")
+    maybe_build_local_admin_provider_oauth_response(
+        &AdminAppState::new(state),
+        &AdminRequestContext::new(&request_context),
+        body_bytes.as_ref(),
+    )
+    .await
+    .expect("local provider oauth response should build")
+    .expect("provider oauth route should resolve locally")
 }
 
 fn sample_kiro_device_access_token(email: &str) -> String {
@@ -2029,9 +2035,13 @@ async fn gateway_refreshes_admin_provider_oauth_key_locally_with_trusted_admin_p
         .as_bool()
         .expect("account_state_recheck_attempted should be bool");
     if account_state_recheck_attempted {
-        assert_eq!(
-            payload["account_state_recheck_error"],
-            "wham/usage API 返回状态码 401"
+        let account_state_recheck_error = payload["account_state_recheck_error"]
+            .as_str()
+            .expect("account_state_recheck_error should be string when attempted");
+        assert!(
+            account_state_recheck_error == "wham/usage API 返回状态码 401"
+                || account_state_recheck_error.starts_with("wham/usage 请求执行失败:"),
+            "unexpected account_state_recheck_error: {account_state_recheck_error}"
         );
     } else {
         assert_eq!(
@@ -2055,7 +2065,9 @@ async fn gateway_refreshes_admin_provider_oauth_key_locally_with_trusted_admin_p
     )
     .expect("refreshed api key should decrypt");
     assert_eq!(decrypted_api_key, "refreshed-codex-access-token");
-    if account_state_recheck_attempted {
+    if account_state_recheck_attempted
+        && payload["account_state_recheck_error"] == "wham/usage API 返回状态码 401"
+    {
         assert!(stored_key.oauth_invalid_at_unix_secs.is_some());
         assert_eq!(
             stored_key.oauth_invalid_reason.as_deref(),

apps/aether-gateway/src/tests/control/admin/pool.rs

@@ -12,6 +12,7 @@ use serde_json::json;
 use super::super::{
     build_router_with_state, sample_endpoint, sample_key, sample_provider, start_server, AppState,
 };
+use crate::admin_api::{maybe_build_local_admin_pool_response, AdminAppState, AdminRequestContext};
 use crate::audit::AdminAuditEvent;
 use crate::constants::{
     GATEWAY_HEADER, TRUSTED_ADMIN_MANAGEMENT_TOKEN_ID_HEADER, TRUSTED_ADMIN_SESSION_ID_HEADER,
@@ -19,7 +20,6 @@ use crate::constants::{
 };
 use crate::control::resolve_public_request_context;
 use crate::data::GatewayDataState;
-use crate::handlers::admin::system::maybe_build_local_admin_pool_response;
 
 fn trusted_admin_headers() -> HeaderMap {
     let mut headers = HeaderMap::new();
@@ -60,10 +60,14 @@ async fn local_admin_pool_response(
     .await
     .expect("request context should resolve");
     let body_bytes = body.map(|value| Bytes::from(value.to_string()));
-    maybe_build_local_admin_pool_response(state, &request_context, body_bytes.as_ref())
-        .await
-        .expect("local pool response should build")
-        .expect("pool route should resolve locally")
+    maybe_build_local_admin_pool_response(
+        &AdminAppState::new(state),
+        &AdminRequestContext::new(&request_context),
+        body_bytes.as_ref(),
+    )
+    .await
+    .expect("local pool response should build")
+    .expect("pool route should resolve locally")
 }
 
 #[tokio::test]

apps/aether-gateway/src/tests/control/admin/provider_ops.rs

@@ -947,8 +947,8 @@ async fn gateway_verifies_admin_provider_ops_locally_for_anyrouter_proxy_mode()
         .and_then(serde_json::Value::as_str)
         .unwrap_or_default();
     assert!(
-        message.starts_with("连接失败:"),
-        "message should include connect error, got: {message}"
+        message.starts_with("连接失败:") || message == "连接超时",
+        "message should report local network verification failure, got: {message}"
     );
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
 

apps/aether-gateway/src/tests/control/admin/providers.rs

@@ -27,6 +27,9 @@ use super::super::{
     sample_provider_model_stats, sample_provider_quota, sample_public_global_model_with_mappings,
     sample_request_candidate, start_server, AppState,
 };
+use crate::admin_api::{
+    maybe_build_local_admin_providers_response, AdminAppState, AdminRequestContext,
+};
 use crate::audit::AdminAuditEvent;
 use crate::constants::{
     GATEWAY_HEADER, TRUSTED_ADMIN_MANAGEMENT_TOKEN_ID_HEADER, TRUSTED_ADMIN_SESSION_ID_HEADER,
@@ -34,7 +37,6 @@ use crate::constants::{
 };
 use crate::control::resolve_public_request_context;
 use crate::data::GatewayDataState;
-use crate::handlers::admin::provider::maybe_build_local_admin_providers_response;
 
 const ADMIN_PROVIDERS_DATA_UNAVAILABLE_DETAIL: &str = "Admin provider catalog data unavailable";
 
@@ -77,10 +79,14 @@ async fn local_admin_providers_response(
     .await
     .expect("request context should resolve");
     let body_bytes = body.map(|value| Bytes::from(value.to_string()));
-    maybe_build_local_admin_providers_response(state, &request_context, body_bytes.as_ref())
-        .await
-        .expect("local providers response should build")
-        .expect("providers route should resolve locally")
+    maybe_build_local_admin_providers_response(
+        &AdminAppState::new(state),
+        &AdminRequestContext::new(&request_context),
+        body_bytes.as_ref(),
+    )
+    .await
+    .expect("local providers response should build")
+    .expect("providers route should resolve locally")
 }
 
 #[tokio::test]

apps/aether-gateway/src/tests/control/admin/security.rs

@@ -7,13 +7,15 @@ use http::{HeaderMap, HeaderValue, StatusCode};
 use serde_json::json;
 
 use super::super::{build_router_with_state, start_server, AppState};
+use crate::admin_api::{
+    maybe_build_local_admin_security_response, AdminAppState, AdminRequestContext,
+};
 use crate::audit::AdminAuditEvent;
 use crate::constants::{
     GATEWAY_HEADER, TRUSTED_ADMIN_MANAGEMENT_TOKEN_ID_HEADER, TRUSTED_ADMIN_SESSION_ID_HEADER,
     TRUSTED_ADMIN_USER_ID_HEADER, TRUSTED_ADMIN_USER_ROLE_HEADER,
 };
 use crate::control::resolve_public_request_context;
-use crate::handlers::admin::auth::maybe_build_local_admin_security_response;
 
 async fn send_admin_security_request(
     gateway: Router,
@@ -98,10 +100,14 @@ async fn local_admin_security_response(
     .await
     .expect("request context should resolve");
     let body_bytes = body.map(|value| Bytes::from(value.to_string()));
-    maybe_build_local_admin_security_response(state, &request_context, body_bytes.as_ref())
-        .await
-        .expect("local security response should build")
-        .expect("security route should resolve locally")
+    maybe_build_local_admin_security_response(
+        &AdminAppState::new(state),
+        &AdminRequestContext::new(&request_context),
+        body_bytes.as_ref(),
+    )
+    .await
+    .expect("local security response should build")
+    .expect("security route should resolve locally")
 }
 
 #[tokio::test]

apps/aether-gateway/src/tests/control/admin/usage.rs

@@ -14,6 +14,9 @@ use super::super::{
     build_router_with_state, issue_test_admin_access_token, sample_endpoint, sample_key,
     sample_provider, start_server, AppState,
 };
+use crate::admin_api::{
+    maybe_build_local_admin_usage_response, AdminAppState, AdminRequestContext,
+};
 use crate::audit::AdminAuditEvent;
 use crate::constants::{
     GATEWAY_HEADER, TRUSTED_ADMIN_MANAGEMENT_TOKEN_ID_HEADER, TRUSTED_ADMIN_SESSION_ID_HEADER,
@@ -21,7 +24,6 @@ use crate::constants::{
 };
 use crate::control::resolve_public_request_context;
 use crate::data::GatewayDataState;
-use crate::handlers::admin::observability::maybe_build_local_admin_usage_response;
 
 const ADMIN_USAGE_DATA_UNAVAILABLE_DETAIL: &str = "Admin usage data unavailable";
 const DAY_1_UNIX_SECS: i64 = 1_711_000_000;
@@ -74,10 +76,14 @@ async fn local_admin_usage_response(
     .await
     .expect("request context should resolve");
     let body_bytes = body.map(|value| Bytes::from(value.to_string()));
-    maybe_build_local_admin_usage_response(state, &request_context, body_bytes.as_ref())
-        .await
-        .expect("local usage response should build")
-        .expect("usage route should resolve locally")
+    maybe_build_local_admin_usage_response(
+        &AdminAppState::new(state),
+        &AdminRequestContext::new(&request_context),
+        body_bytes.as_ref(),
+    )
+    .await
+    .expect("local usage response should build")
+    .expect("usage route should resolve locally")
 }
 
 async fn start_usage_upstream(

apps/aether-gateway/src/tests/control/admin/video_tasks.rs

@@ -18,6 +18,9 @@ use super::super::{
     build_router_with_state, build_state_with_execution_runtime_override, sample_endpoint,
     sample_key, sample_provider, start_server, AppState,
 };
+use crate::admin_api::{
+    maybe_build_local_admin_video_tasks_response, AdminAppState, AdminRequestContext,
+};
 use crate::audit::AdminAuditEvent;
 use crate::constants::{
     GATEWAY_HEADER, TRUSTED_ADMIN_MANAGEMENT_TOKEN_ID_HEADER, TRUSTED_ADMIN_SESSION_ID_HEADER,
@@ -25,7 +28,6 @@ use crate::constants::{
 };
 use crate::control::resolve_public_request_context;
 use crate::data::GatewayDataState;
-use crate::handlers::admin::features::maybe_build_local_admin_video_tasks_response;
 
 fn trusted_admin_headers() -> HeaderMap {
     let mut headers = HeaderMap::new();
@@ -65,10 +67,13 @@ async fn local_admin_video_tasks_response(
     )
     .await
     .expect("request context should resolve");
-    maybe_build_local_admin_video_tasks_response(state, &request_context)
-        .await
-        .expect("local video tasks response should build")
-        .expect("video tasks route should resolve locally")
+    maybe_build_local_admin_video_tasks_response(
+        &AdminAppState::new(state),
+        &AdminRequestContext::new(&request_context),
+    )
+    .await
+    .expect("local video tasks response should build")
+    .expect("video tasks route should resolve locally")
 }
 
 fn sample_admin_video_task(