refactor: 大规模模块拆分与重组，新增 aether-admin crate

- 新建独立 aether-admin crate 承载 admin 相关共享契约与纯辅助函数
- 拆分 ai_pipeline 下 kiro/private_envelope/conversion/planner 等大文件为子模块目录
- 重组 admin handlers 各业务域（billing/oauth/provider/system/users 等）为目录结构，移除 shared.rs/builders.rs 等反模式
- 移除 ai_pipeline runtime adapters 旧实现（claude/openai/gemini/kiro/vertex/antigravity 等），改由 provider transport 统一承载
- 移除 control_facade/execution_facade/auth_snapshot_facade 等冗余 facade 层
- 拆分 query/billing 与 query/monitoring 模块、state/runtime/payments 与 security 模块
- 扩展架构测试覆盖 admin_billing/admin_model/admin_users 等新模块
- 删除 docs/architecture/refactor-execution-plan.md 已完成的执行计划文档

crates/aether-ai-pipeline/src/conversion/mod.rs

@@ -9,6 +9,8 @@ pub use error::{
     is_core_error_finalize_kind, LocalCoreSyncErrorKind,
 };
 pub use registry::{
-    request_conversion_kind, sync_chat_response_conversion_kind, sync_cli_response_conversion_kind,
-    RequestConversionKind, SyncChatResponseConversionKind, SyncCliResponseConversionKind,
+    request_conversion_direct_auth, request_conversion_kind,
+    request_conversion_transport_supported, sync_chat_response_conversion_kind,
+    sync_cli_response_conversion_kind, RequestConversionKind, SyncChatResponseConversionKind,
+    SyncCliResponseConversionKind,
 };

crates/aether-ai-pipeline/src/conversion/registry.rs

@@ -1,5 +1,15 @@
 #![allow(dead_code)]
 
+use aether_provider_transport::auth::{
+    resolve_local_gemini_auth, resolve_local_openai_chat_auth, resolve_local_standard_auth,
+};
+use aether_provider_transport::policy::{
+    supports_local_openai_chat_transport, supports_local_standard_transport_with_network,
+};
+use aether_provider_transport::{
+    supports_local_gemini_transport_with_network, GatewayProviderTransportSnapshot,
+};
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum RequestConversionKind {
     ToOpenAIChat,
@@ -88,6 +98,50 @@ pub fn sync_cli_response_conversion_kind(
     }
 }
 
+pub fn request_conversion_transport_supported(
+    transport: &GatewayProviderTransportSnapshot,
+    _kind: RequestConversionKind,
+) -> bool {
+    match transport
+        .endpoint
+        .api_format
+        .trim()
+        .to_ascii_lowercase()
+        .as_str()
+    {
+        "openai:chat" => supports_local_openai_chat_transport(transport),
+        "openai:cli" => supports_local_standard_transport_with_network(transport, "openai:cli"),
+        "openai:compact" => {
+            supports_local_standard_transport_with_network(transport, "openai:compact")
+        }
+        "claude:chat" => supports_local_standard_transport_with_network(transport, "claude:chat"),
+        "claude:cli" => supports_local_standard_transport_with_network(transport, "claude:cli"),
+        "gemini:chat" => supports_local_gemini_transport_with_network(transport, "gemini:chat"),
+        "gemini:cli" => supports_local_gemini_transport_with_network(transport, "gemini:cli"),
+        _ => false,
+    }
+}
+
+pub fn request_conversion_direct_auth(
+    transport: &GatewayProviderTransportSnapshot,
+    _kind: RequestConversionKind,
+) -> Option<(String, String)> {
+    match transport
+        .endpoint
+        .api_format
+        .trim()
+        .to_ascii_lowercase()
+        .as_str()
+    {
+        "openai:chat" => resolve_local_openai_chat_auth(transport),
+        "gemini:chat" | "gemini:cli" => resolve_local_gemini_auth(transport),
+        "openai:cli" | "openai:compact" | "claude:chat" | "claude:cli" => {
+            resolve_local_standard_auth(transport)
+        }
+        _ => None,
+    }
+}
+
 fn is_standard_api_format(api_format: &str) -> bool {
     matches!(
         api_format,
@@ -104,10 +158,15 @@ fn is_standard_api_format(api_format: &str) -> bool {
 #[cfg(test)]
 mod tests {
     use super::{
-        request_conversion_kind, sync_chat_response_conversion_kind,
+        request_conversion_direct_auth, request_conversion_kind,
+        request_conversion_transport_supported, sync_chat_response_conversion_kind,
         sync_cli_response_conversion_kind, RequestConversionKind, SyncChatResponseConversionKind,
         SyncCliResponseConversionKind,
     };
+    use aether_provider_transport::snapshot::{
+        GatewayProviderTransportEndpoint, GatewayProviderTransportKey,
+        GatewayProviderTransportProvider, GatewayProviderTransportSnapshot,
+    };
 
     #[test]
     fn request_conversion_registry_supports_bidirectional_standard_matrix() {
@@ -157,4 +216,67 @@ mod tests {
             Some(SyncCliResponseConversionKind::ToClaudeCli)
         );
     }
+
+    #[test]
+    fn request_conversion_helpers_follow_transport_api_format() {
+        let transport = GatewayProviderTransportSnapshot {
+            provider: GatewayProviderTransportProvider {
+                id: "provider-1".to_string(),
+                name: "provider".to_string(),
+                provider_type: "openai".to_string(),
+                website: None,
+                is_active: true,
+                keep_priority_on_conversion: false,
+                enable_format_conversion: true,
+                concurrent_limit: None,
+                max_retries: None,
+                proxy: None,
+                request_timeout_secs: None,
+                stream_first_byte_timeout_secs: None,
+                config: None,
+            },
+            endpoint: GatewayProviderTransportEndpoint {
+                id: "endpoint-1".to_string(),
+                provider_id: "provider-1".to_string(),
+                api_format: "openai:chat".to_string(),
+                api_family: Some("openai".to_string()),
+                endpoint_kind: Some("chat".to_string()),
+                is_active: true,
+                base_url: "https://api.openai.com".to_string(),
+                header_rules: None,
+                body_rules: None,
+                max_retries: None,
+                custom_path: None,
+                config: None,
+                format_acceptance_config: None,
+                proxy: None,
+            },
+            key: GatewayProviderTransportKey {
+                id: "key-1".to_string(),
+                provider_id: "provider-1".to_string(),
+                name: "key".to_string(),
+                auth_type: "bearer".to_string(),
+                is_active: true,
+                api_formats: None,
+                allowed_models: None,
+                capabilities: None,
+                rate_multipliers: None,
+                global_priority_by_format: None,
+                expires_at_unix_secs: None,
+                proxy: None,
+                fingerprint: None,
+                decrypted_api_key: "secret".to_string(),
+                decrypted_auth_config: None,
+            },
+        };
+
+        assert!(request_conversion_transport_supported(
+            &transport,
+            RequestConversionKind::ToOpenAIChat
+        ));
+        assert_eq!(
+            request_conversion_direct_auth(&transport, RequestConversionKind::ToOpenAIChat),
+            Some(("authorization".to_string(), "Bearer secret".to_string()))
+        );
+    }
 }