feat(security): harden gateway boundaries and usage policies

Consolidate subscription usage policy enforcement, privacy-safe persistence, and gateway security hardening into one reviewable change.

Includes bounded HTTP and execution envelopes, header and protocol guards, DNS and relay validation, authentication and secret projection hardening, secure backup/install paths, and regression coverage.

crates/aether-provider/pool/src/quota_refresh.rs

@@ -1,8 +1,10 @@
 use std::collections::BTreeMap;
+use std::fmt;
 
+use aether_contracts::redact_url_for_debug;
 use serde_json::Value;
 
-#[derive(Debug, Clone, PartialEq)]
+#[derive(Clone, PartialEq)]
 pub struct ProviderPoolQuotaRequestSpec {
     pub request_id: String,
     pub provider_name: String,
@@ -15,5 +17,30 @@ pub struct ProviderPoolQuotaRequestSpec {
     pub client_api_format: String,
     pub provider_api_format: String,
     pub model_name: Option<String>,
-    pub accept_invalid_certs: bool,
+}
+
+impl fmt::Debug for ProviderPoolQuotaRequestSpec {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("ProviderPoolQuotaRequestSpec")
+            .field("request_id", &self.request_id)
+            .field("provider_name", &self.provider_name)
+            .field("quota_kind", &self.quota_kind)
+            .field("method", &self.method)
+            .field("url", &redact_url_for_debug(&self.url))
+            .field("header_names", &self.headers.keys().collect::<Vec<_>>())
+            .field("content_type", &self.content_type)
+            .field("has_json_body", &self.json_body.is_some())
+            .field(
+                "json_body_bytes",
+                &self
+                    .json_body
+                    .as_ref()
+                    .and_then(|body| serde_json::to_vec(body).ok().map(|bytes| bytes.len())),
+            )
+            .field("client_api_format", &self.client_api_format)
+            .field("provider_api_format", &self.provider_api_format)
+            .field("model_name", &self.model_name)
+            .finish()
+    }
 }