refactor: 大规模模块拆分与重组，新增 aether-admin crate

- 新建独立 aether-admin crate 承载 admin 相关共享契约与纯辅助函数
- 拆分 ai_pipeline 下 kiro/private_envelope/conversion/planner 等大文件为子模块目录
- 重组 admin handlers 各业务域（billing/oauth/provider/system/users 等）为目录结构，移除 shared.rs/builders.rs 等反模式
- 移除 ai_pipeline runtime adapters 旧实现（claude/openai/gemini/kiro/vertex/antigravity 等），改由 provider transport 统一承载
- 移除 control_facade/execution_facade/auth_snapshot_facade 等冗余 facade 层
- 拆分 query/billing 与 query/monitoring 模块、state/runtime/payments 与 security 模块
- 扩展架构测试覆盖 admin_billing/admin_model/admin_users 等新模块
- 删除 docs/architecture/refactor-execution-plan.md 已完成的执行计划文档

crates/aether-provider-transport/src/headers.rs

@@ -19,8 +19,18 @@ pub fn should_skip_request_header(name: &str) -> bool {
 }
 
 pub fn should_skip_upstream_passthrough_header(name: &str) -> bool {
+    let lower = name.to_ascii_lowercase();
+    // Anthropic SDK (stainless) client metadata and Anthropic-specific headers
+    // (anthropic-version / anthropic-beta / anthropic-dangerous-direct-browser-access / ...).
+    // These are only meaningful when the upstream is Anthropic. The Claude Code
+    // adapter re-reads what it needs directly from the original HeaderMap and
+    // injects its own values *after* this filter runs, so stripping both prefixes
+    // here prevents leakage to any other upstream (OpenAI/Gemini/Codex/...).
+    if lower.starts_with("x-stainless-") || lower.starts_with("anthropic-") {
+        return true;
+    }
     matches!(
-        name.to_ascii_lowercase().as_str(),
+        lower.as_str(),
         "authorization"
             | "x-api-key"
             | "x-goog-api-key"
@@ -37,5 +47,66 @@ pub fn should_skip_upstream_passthrough_header(name: &str) -> bool {
             | "x-forwarded-scheme"
             | "x-forwarded-host"
             | "x-forwarded-port"
+            // Claude CLI client identifier; re-injected by the Claude Code adapter
+            // when the upstream is Anthropic, filtered for everybody else.
+            | "x-app"
     ) || should_skip_request_header(name)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::should_skip_upstream_passthrough_header;
+
+    #[test]
+    fn strips_all_stainless_headers() {
+        let stainless = [
+            "x-stainless-arch",
+            "x-stainless-lang",
+            "x-stainless-os",
+            "x-stainless-package-version",
+            "x-stainless-retry-count",
+            "x-stainless-runtime",
+            "x-stainless-runtime-version",
+            "x-stainless-timeout",
+            "x-stainless-helper-method",
+            "X-Stainless-Arch",
+            "X-STAINLESS-FUTURE-HEADER",
+        ];
+        for h in stainless {
+            assert!(
+                should_skip_upstream_passthrough_header(h),
+                "should skip {h}"
+            );
+        }
+    }
+
+    #[test]
+    fn strips_anthropic_and_claude_cli_identity_headers() {
+        let anthropic = [
+            "anthropic-version",
+            "anthropic-beta",
+            "anthropic-dangerous-direct-browser-access",
+            "Anthropic-Version",
+            "ANTHROPIC-FUTURE-HEADER",
+            "x-app",
+            "X-App",
+        ];
+        for h in anthropic {
+            assert!(
+                should_skip_upstream_passthrough_header(h),
+                "should skip {h}"
+            );
+        }
+    }
+
+    #[test]
+    fn allows_normal_headers_through() {
+        let allowed = ["user-agent", "accept", "content-type", "x-custom-header"];
+        for h in allowed {
+            assert!(
+                !should_skip_upstream_passthrough_header(h),
+                "should allow {h}"
+            );
+        }
+    }
+}