refactor: 大规模模块拆分与重组，新增 aether-admin crate

- 新建独立 aether-admin crate 承载 admin 相关共享契约与纯辅助函数
- 拆分 ai_pipeline 下 kiro/private_envelope/conversion/planner 等大文件为子模块目录
- 重组 admin handlers 各业务域（billing/oauth/provider/system/users 等）为目录结构，移除 shared.rs/builders.rs 等反模式
- 移除 ai_pipeline runtime adapters 旧实现（claude/openai/gemini/kiro/vertex/antigravity 等），改由 provider transport 统一承载
- 移除 control_facade/execution_facade/auth_snapshot_facade 等冗余 facade 层
- 拆分 query/billing 与 query/monitoring 模块、state/runtime/payments 与 security 模块
- 扩展架构测试覆盖 admin_billing/admin_model/admin_users 等新模块
- 删除 docs/architecture/refactor-execution-plan.md 已完成的执行计划文档

crates/aether-ai-pipeline/src/finalize/common.rs

@@ -1,5 +1,10 @@
+use std::collections::BTreeMap;
+
+use aether_usage_runtime::GatewaySyncReportRequest;
 use serde_json::Value;
 
+use crate::contracts::core_success_background_report_kind;
+
 pub fn build_generated_tool_call_id(index: usize) -> String {
     format!("call_auto_{index}")
 }
@@ -11,3 +16,172 @@ pub fn canonicalize_tool_arguments(value: Option<Value>) -> String {
         None => "{}".to_string(),
     }
 }
+
+pub fn prepare_local_success_response_parts(
+    headers: &BTreeMap<String, String>,
+    body_json: &Value,
+) -> serde_json::Result<(Vec<u8>, BTreeMap<String, String>)> {
+    let mut headers = headers.clone();
+    headers.remove("content-encoding");
+    headers.remove("content-length");
+    headers.insert("content-type".to_string(), "application/json".to_string());
+    let body_bytes = serde_json::to_vec(body_json)?;
+    headers.insert("content-length".to_string(), body_bytes.len().to_string());
+    Ok((body_bytes, headers))
+}
+
+pub fn build_local_success_background_report(
+    payload: &GatewaySyncReportRequest,
+    body_json: Value,
+    headers: BTreeMap<String, String>,
+) -> Option<GatewaySyncReportRequest> {
+    let report_kind = core_success_background_report_kind(payload.report_kind.as_str())?;
+
+    Some(GatewaySyncReportRequest {
+        trace_id: payload.trace_id.clone(),
+        report_kind: report_kind.to_string(),
+        report_context: payload.report_context.clone(),
+        status_code: payload.status_code,
+        headers,
+        body_json: Some(body_json),
+        client_body_json: None,
+        body_base64: None,
+        telemetry: payload.telemetry.clone(),
+    })
+}
+
+pub fn build_local_success_conversion_background_report(
+    payload: &GatewaySyncReportRequest,
+    client_body_json: Value,
+    provider_body_json: Value,
+) -> Option<GatewaySyncReportRequest> {
+    let report_kind = core_success_background_report_kind(payload.report_kind.as_str())?;
+
+    Some(GatewaySyncReportRequest {
+        trace_id: payload.trace_id.clone(),
+        report_kind: report_kind.to_string(),
+        report_context: payload.report_context.clone(),
+        status_code: payload.status_code,
+        headers: payload.headers.clone(),
+        body_json: Some(provider_body_json),
+        client_body_json: Some(client_body_json),
+        body_base64: None,
+        telemetry: payload.telemetry.clone(),
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::Value;
+
+    use super::{
+        build_generated_tool_call_id, build_local_success_background_report,
+        build_local_success_conversion_background_report, canonicalize_tool_arguments,
+        prepare_local_success_response_parts,
+    };
+    use aether_usage_runtime::GatewaySyncReportRequest;
+    use std::collections::BTreeMap;
+
+    #[test]
+    fn generated_tool_call_ids_are_stable() {
+        assert_eq!(build_generated_tool_call_id(3), "call_auto_3");
+    }
+
+    #[test]
+    fn canonicalizes_tool_arguments() {
+        assert_eq!(
+            canonicalize_tool_arguments(Some(serde_json::json!({"x": 1}))),
+            "{\"x\":1}"
+        );
+        assert_eq!(canonicalize_tool_arguments(None), "{}");
+    }
+
+    #[test]
+    fn prepare_local_success_response_parts_normalizes_headers() {
+        let headers = BTreeMap::from([
+            ("content-encoding".to_string(), "gzip".to_string()),
+            ("content-length".to_string(), "999".to_string()),
+            ("x-test".to_string(), "1".to_string()),
+        ]);
+        let (body_bytes, normalized_headers) =
+            prepare_local_success_response_parts(&headers, &serde_json::json!({"ok": true}))
+                .expect("response parts should serialize");
+
+        assert_eq!(
+            serde_json::from_slice::<Value>(&body_bytes).expect("json body"),
+            serde_json::json!({"ok": true})
+        );
+        assert_eq!(
+            normalized_headers.get("content-type").map(String::as_str),
+            Some("application/json")
+        );
+        assert!(!normalized_headers.contains_key("content-encoding"));
+        let expected_length = body_bytes.len().to_string();
+        assert_eq!(
+            normalized_headers.get("content-length").map(String::as_str),
+            Some(expected_length.as_str())
+        );
+        assert_eq!(
+            normalized_headers.get("x-test").map(String::as_str),
+            Some("1")
+        );
+    }
+
+    #[test]
+    fn build_local_success_background_report_maps_finalize_kind() {
+        let payload = GatewaySyncReportRequest {
+            trace_id: "trace-1".to_string(),
+            report_kind: "openai_chat_sync_finalize".to_string(),
+            report_context: Some(serde_json::json!({"request_id": "req-1"})),
+            status_code: 200,
+            headers: BTreeMap::from([("x-test".to_string(), "1".to_string())]),
+            body_json: None,
+            client_body_json: None,
+            body_base64: None,
+            telemetry: None,
+        };
+
+        let report = build_local_success_background_report(
+            &payload,
+            serde_json::json!({"id": "resp-1"}),
+            payload.headers.clone(),
+        )
+        .expect("success report should be built");
+
+        assert_eq!(report.report_kind, "openai_chat_sync_success");
+        assert_eq!(report.body_json, Some(serde_json::json!({"id": "resp-1"})));
+        assert_eq!(report.client_body_json, None);
+    }
+
+    #[test]
+    fn build_local_success_conversion_background_report_maps_provider_body() {
+        let payload = GatewaySyncReportRequest {
+            trace_id: "trace-2".to_string(),
+            report_kind: "openai_chat_sync_finalize".to_string(),
+            report_context: Some(serde_json::json!({"request_id": "req-2"})),
+            status_code: 200,
+            headers: BTreeMap::from([("content-type".to_string(), "application/json".to_string())]),
+            body_json: None,
+            client_body_json: None,
+            body_base64: None,
+            telemetry: None,
+        };
+
+        let report = build_local_success_conversion_background_report(
+            &payload,
+            serde_json::json!({"client": true}),
+            serde_json::json!({"provider": true}),
+        )
+        .expect("conversion success report should be built");
+
+        assert_eq!(report.report_kind, "openai_chat_sync_success");
+        assert_eq!(
+            report.body_json,
+            Some(serde_json::json!({"provider": true}))
+        );
+        assert_eq!(
+            report.client_body_json,
+            Some(serde_json::json!({"client": true}))
+        );
+    }
+}