refactor: 大规模模块拆分与代码精简，新增 ai-pipeline/data-contracts 独立 crate

- 新增 aether-ai-pipeline 和 aether-data-contracts crate，将 pipeline 逻辑与数据契约从 gateway 中解耦
- 重构 admin handlers：拆分单体模块为 auth/billing/endpoint/features/model/observability/provider/system 等独立子模块
- 合并 chat/cli 重复代码路径：精简 conversion、finalize、planner 中的 sync/chat/cli 分支
- 重构 scheduler/executor/data 层，引入 facade 模式降低模块间耦合
- 移除冗余的 intent 模块，将 plan_fallback/policy/stream_path/sync_path 迁移至 executor
- 前端适配：调整 admin API 调用和 provider 模型测试对话框

apps/aether-gateway/src/control/auth/credentials.rs

@@ -126,22 +126,14 @@ fn extract_trusted_auth_headers(headers: &http::HeaderMap) -> Option<GatewayTrus
     if !has_trusted_gateway_marker(headers) {
         return None;
     }
-    let user_id = header_value_str(
-        headers,
-        crate::constants::TRUSTED_AUTH_USER_ID_HEADER,
-    )
-    .filter(|value| !value.is_empty())?;
-    let api_key_id = header_value_str(
-        headers,
-        crate::constants::TRUSTED_AUTH_API_KEY_ID_HEADER,
-    )
-    .filter(|value| !value.is_empty())?;
-    let balance_remaining = header_value_str(
-        headers,
-        crate::constants::TRUSTED_AUTH_BALANCE_HEADER,
-    )
-    .as_deref()
-    .and_then(parse_f64_header);
+    let user_id = header_value_str(headers, crate::constants::TRUSTED_AUTH_USER_ID_HEADER)
+        .filter(|value| !value.is_empty())?;
+    let api_key_id = header_value_str(headers, crate::constants::TRUSTED_AUTH_API_KEY_ID_HEADER)
+        .filter(|value| !value.is_empty())?;
+    let balance_remaining =
+        header_value_str(headers, crate::constants::TRUSTED_AUTH_BALANCE_HEADER)
+            .as_deref()
+            .and_then(parse_f64_header);
     let access_allowed = header_value_str(
         headers,
         crate::constants::TRUSTED_AUTH_ACCESS_ALLOWED_HEADER,
@@ -163,30 +155,21 @@ pub(super) fn extract_trusted_admin_headers(
     if !has_trusted_gateway_marker(headers) {
         return None;
     }
-    let user_id = header_value_str(
-        headers,
-        crate::constants::TRUSTED_ADMIN_USER_ID_HEADER,
-    )?
-    .trim()
-    .to_string();
+    let user_id = header_value_str(headers, crate::constants::TRUSTED_ADMIN_USER_ID_HEADER)?
+        .trim()
+        .to_string();
     if user_id.is_empty() {
         return None;
     }
-    let user_role = header_value_str(
-        headers,
-        crate::constants::TRUSTED_ADMIN_USER_ROLE_HEADER,
-    )?
-    .trim()
-    .to_string();
+    let user_role = header_value_str(headers, crate::constants::TRUSTED_ADMIN_USER_ROLE_HEADER)?
+        .trim()
+        .to_string();
     if !user_role.eq_ignore_ascii_case("admin") {
         return None;
     }
-    let session_id = header_value_str(
-        headers,
-        crate::constants::TRUSTED_ADMIN_SESSION_ID_HEADER,
-    )
-    .map(|value| value.trim().to_string())
-    .filter(|value| !value.is_empty());
+    let session_id = header_value_str(headers, crate::constants::TRUSTED_ADMIN_SESSION_ID_HEADER)
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty());
     let management_token_id = header_value_str(
         headers,
         crate::constants::TRUSTED_ADMIN_MANAGEMENT_TOKEN_ID_HEADER,

apps/aether-gateway/src/control/auth/resolution.rs

@@ -7,9 +7,7 @@ use serde::{Deserialize, Serialize};
 use serde_json::Value;
 use tracing::{debug, info};
 
-use crate::wallet_runtime::{
-    local_rejection_from_wallet_access, resolve_wallet_auth_gate,
-};
+use crate::wallet_runtime::{local_rejection_from_wallet_access, resolve_wallet_auth_gate};
 use crate::{AppState, GatewayError};
 
 use super::super::GatewayControlDecision;
@@ -483,8 +481,10 @@ pub(super) async fn resolve_data_backed_auth_context(
         }
         Some(GatewayPrincipalCandidate::ApiKeyHash { key_hash, .. }) => {
             let snapshot = state
+                .data
                 .read_auth_api_key_snapshot_by_key_hash(&key_hash, now_unix_secs)
-                .await?;
+                .await
+                .map_err(|err| GatewayError::Internal(err.to_string()))?;
             let Some(snapshot) = snapshot else {
                 return Ok(Some(GatewayControlAuthContext {
                     user_id: String::new(),
@@ -527,12 +527,14 @@ async fn resolve_trusted_auth_context(
     now_unix_secs: u64,
 ) -> Result<Option<GatewayControlAuthContext>, GatewayError> {
     let snapshot = state
+        .data
         .read_auth_api_key_snapshot(
             &trusted_headers.user_id,
             &trusted_headers.api_key_id,
             now_unix_secs,
         )
-        .await?;
+        .await
+        .map_err(|err| GatewayError::Internal(err.to_string()))?;
     let Some(snapshot) = snapshot else {
         return Ok(Some(GatewayControlAuthContext {
             user_id: trusted_headers.user_id,