refactor: 大规模模块拆分与代码精简，新增 ai-pipeline/data-contracts 独立 crate

- 新增 aether-ai-pipeline 和 aether-data-contracts crate，将 pipeline 逻辑与数据契约从 gateway 中解耦
- 重构 admin handlers：拆分单体模块为 auth/billing/endpoint/features/model/observability/provider/system 等独立子模块
- 合并 chat/cli 重复代码路径：精简 conversion、finalize、planner 中的 sync/chat/cli 分支
- 重构 scheduler/executor/data 层，引入 facade 模式降低模块间耦合
- 移除冗余的 intent 模块，将 plan_fallback/policy/stream_path/sync_path 迁移至 executor
- 前端适配：调整 admin API 调用和 provider 模型测试对话框

apps/aether-gateway/src/handlers/admin/system/adaptive/mod.rs

@@ -0,0 +1,15 @@
+use crate::control::GatewayPublicRequestContext;
+use crate::{AppState, GatewayError};
+use axum::body::{Body, Bytes};
+use axum::http::Response;
+
+mod routes;
+mod shared;
+
+pub(crate) async fn maybe_build_local_admin_adaptive_response(
+    state: &AppState,
+    request_context: &GatewayPublicRequestContext,
+    request_body: Option<&Bytes>,
+) -> Result<Option<Response<Body>>, GatewayError> {
+    routes::maybe_build_local_admin_adaptive_response(state, request_context, request_body).await
+}

apps/aether-gateway/src/handlers/admin/system/adaptive/routes.rs

@@ -0,0 +1,348 @@
+use super::super::super::auth::build_proxy_error_response;
+use super::shared::{
+    admin_adaptive_adjustment_items, admin_adaptive_dispatcher_not_found_response,
+    admin_adaptive_effective_limit, admin_adaptive_find_key, admin_adaptive_key_id_from_path,
+    admin_adaptive_key_not_found_response, admin_adaptive_key_payload,
+    admin_adaptive_load_candidate_keys,
+};
+use crate::control::GatewayPublicRequestContext;
+use crate::handlers::admin::shared::{query_param_value, unix_secs_to_rfc3339};
+use crate::{AppState, GatewayError};
+use axum::{
+    body::{Body, Bytes},
+    http,
+    response::{IntoResponse, Response},
+    Json,
+};
+use serde::Deserialize;
+use serde_json::json;
+
+const ADMIN_ADAPTIVE_DATA_UNAVAILABLE_DETAIL: &str = "Admin adaptive data unavailable";
+
+#[derive(Debug, Deserialize)]
+struct AdminAdaptiveToggleModeRequest {
+    enabled: bool,
+    #[serde(default)]
+    fixed_limit: Option<u32>,
+}
+
+pub(super) async fn maybe_build_local_admin_adaptive_response(
+    state: &AppState,
+    request_context: &GatewayPublicRequestContext,
+    request_body: Option<&Bytes>,
+) -> Result<Option<Response<Body>>, GatewayError> {
+    let Some(decision) = request_context.control_decision.as_ref() else {
+        return Ok(None);
+    };
+
+    if decision.route_family.as_deref() != Some("adaptive_manage") {
+        return Ok(None);
+    }
+
+    if !state.has_provider_catalog_data_reader() {
+        return Ok(Some(build_proxy_error_response(
+            http::StatusCode::SERVICE_UNAVAILABLE,
+            "data_unavailable",
+            ADMIN_ADAPTIVE_DATA_UNAVAILABLE_DETAIL,
+            Some(json!({
+                "error": ADMIN_ADAPTIVE_DATA_UNAVAILABLE_DETAIL,
+            })),
+        )));
+    }
+
+    if decision.route_kind.as_deref() == Some("list_keys")
+        && request_context.request_method == http::Method::GET
+        && matches!(
+            request_context.request_path.as_str(),
+            "/api/admin/adaptive/keys" | "/api/admin/adaptive/keys/"
+        )
+    {
+        let provider_id = query_param_value(
+            request_context.request_query_string.as_deref(),
+            "provider_id",
+        );
+        let payload = admin_adaptive_load_candidate_keys(state, provider_id.as_deref())
+            .await?
+            .into_iter()
+            .filter(|key| key.rpm_limit.is_none())
+            .map(|key| admin_adaptive_key_payload(&key))
+            .collect::<Vec<_>>();
+        return Ok(Some(Json(payload).into_response()));
+    }
+
+    if decision.route_kind.as_deref() == Some("summary")
+        && request_context.request_method == http::Method::GET
+        && matches!(
+            request_context.request_path.as_str(),
+            "/api/admin/adaptive/summary" | "/api/admin/adaptive/summary/"
+        )
+    {
+        let keys = admin_adaptive_load_candidate_keys(state, None).await?;
+        let adaptive_keys = keys
+            .into_iter()
+            .filter(|key| key.rpm_limit.is_none())
+            .collect::<Vec<_>>();
+
+        let total_keys = adaptive_keys.len() as u64;
+        let total_concurrent_429 = adaptive_keys
+            .iter()
+            .map(|key| u64::from(key.concurrent_429_count.unwrap_or(0)))
+            .sum::<u64>();
+        let total_rpm_429 = adaptive_keys
+            .iter()
+            .map(|key| u64::from(key.rpm_429_count.unwrap_or(0)))
+            .sum::<u64>();
+        let mut recent_adjustments = vec![];
+        let mut total_adjustments = 0usize;
+        for key in adaptive_keys {
+            let history = admin_adaptive_adjustment_items(key.adjustment_history.as_ref());
+            total_adjustments += history.len();
+            for adjustment in history.into_iter().rev().take(3) {
+                let mut payload = adjustment;
+                payload.insert("key_id".to_string(), json!(key.id));
+                payload.insert("key_name".to_string(), json!(key.name));
+                recent_adjustments.push(serde_json::Value::Object(payload));
+            }
+        }
+        recent_adjustments.sort_by(|left, right| {
+            let lhs = left
+                .get("timestamp")
+                .and_then(serde_json::Value::as_str)
+                .unwrap_or_default();
+            let rhs = right
+                .get("timestamp")
+                .and_then(serde_json::Value::as_str)
+                .unwrap_or_default();
+            rhs.cmp(lhs)
+        });
+
+        return Ok(Some(
+            Json(json!({
+                "total_adaptive_keys": total_keys,
+                "total_concurrent_429_errors": total_concurrent_429,
+                "total_rpm_429_errors": total_rpm_429,
+                "total_adjustments": total_adjustments,
+                "recent_adjustments": recent_adjustments.into_iter().take(10).collect::<Vec<_>>(),
+            }))
+            .into_response(),
+        ));
+    }
+
+    let key_id = admin_adaptive_key_id_from_path(&request_context.request_path);
+    if key_id.is_none() {
+        return Ok(Some(admin_adaptive_dispatcher_not_found_response()));
+    }
+    let key_id = key_id.expect("checked is_some above");
+
+    if decision.route_kind.as_deref() == Some("get_stats")
+        && request_context.request_method == http::Method::GET
+        && request_context.request_path.ends_with("/stats")
+    {
+        let Some(key) = admin_adaptive_find_key(state, &key_id).await? else {
+            return Ok(Some(admin_adaptive_key_not_found_response(&key_id)));
+        };
+        let status_snapshot = key
+            .status_snapshot
+            .as_ref()
+            .and_then(serde_json::Value::as_object);
+        let adjustments = admin_adaptive_adjustment_items(key.adjustment_history.as_ref());
+        let adjustment_count = adjustments.len();
+        let recent_adjustments = adjustments
+            .into_iter()
+            .rev()
+            .take(10)
+            .map(serde_json::Value::Object)
+            .collect::<Vec<_>>();
+
+        return Ok(Some(
+            Json(json!({
+                "adaptive_mode": key.rpm_limit.is_none(),
+                "rpm_limit": key.rpm_limit,
+                "effective_limit": admin_adaptive_effective_limit(&key),
+                "learned_limit": key.learned_rpm_limit,
+                "concurrent_429_count": key.concurrent_429_count.unwrap_or(0),
+                "rpm_429_count": key.rpm_429_count.unwrap_or(0),
+                "last_429_at": key.last_429_at_unix_secs.and_then(unix_secs_to_rfc3339),
+                "last_429_type": key.last_429_type,
+                "adjustment_count": adjustment_count,
+                "recent_adjustments": recent_adjustments,
+                "learning_confidence": status_snapshot.and_then(|value| value.get("learning_confidence")).cloned(),
+                "enforcement_active": status_snapshot.and_then(|value| value.get("enforcement_active")).cloned(),
+                "observation_count": status_snapshot
+                    .and_then(|value| value.get("observation_count"))
+                    .and_then(serde_json::Value::as_u64)
+                    .unwrap_or(0),
+                "header_observation_count": status_snapshot
+                    .and_then(|value| value.get("header_observation_count"))
+                    .and_then(serde_json::Value::as_u64)
+                    .unwrap_or(0),
+                "latest_upstream_limit": status_snapshot
+                    .and_then(|value| value.get("latest_upstream_limit"))
+                    .and_then(serde_json::Value::as_u64),
+            }))
+            .into_response(),
+        ));
+    }
+
+    if !state.has_provider_catalog_data_writer() {
+        return Ok(Some(build_proxy_error_response(
+            http::StatusCode::SERVICE_UNAVAILABLE,
+            "data_unavailable",
+            ADMIN_ADAPTIVE_DATA_UNAVAILABLE_DETAIL,
+            Some(json!({
+                "error": ADMIN_ADAPTIVE_DATA_UNAVAILABLE_DETAIL,
+            })),
+        )));
+    }
+
+    if decision.route_kind.as_deref() == Some("toggle_mode")
+        && request_context.request_method == http::Method::PATCH
+        && request_context.request_path.ends_with("/mode")
+    {
+        let Some(request_body) = request_body else {
+            return Ok(Some(build_proxy_error_response(
+                http::StatusCode::BAD_REQUEST,
+                "invalid_request",
+                "请求数据验证失败",
+                None,
+            )));
+        };
+        let body = match serde_json::from_slice::<AdminAdaptiveToggleModeRequest>(request_body) {
+            Ok(payload) => payload,
+            Err(_) => {
+                return Ok(Some(build_proxy_error_response(
+                    http::StatusCode::BAD_REQUEST,
+                    "invalid_request",
+                    "请求数据验证失败",
+                    None,
+                )));
+            }
+        };
+        let Some(mut key) = admin_adaptive_find_key(state, &key_id).await? else {
+            return Ok(Some(admin_adaptive_key_not_found_response(&key_id)));
+        };
+        let message = if body.enabled {
+            key.rpm_limit = None;
+            "已切换为自适应模式，系统将自动学习并调整 RPM 限制".to_string()
+        } else {
+            let Some(fixed_limit) = body.fixed_limit else {
+                return Ok(Some(
+                    (
+                        http::StatusCode::BAD_REQUEST,
+                        Json(json!({
+                            "detail": "禁用自适应模式时必须提供 fixed_limit 参数",
+                        })),
+                    )
+                        .into_response(),
+                ));
+            };
+            if !(1..=100).contains(&fixed_limit) {
+                return Ok(Some(
+                    (
+                        http::StatusCode::BAD_REQUEST,
+                        Json(json!({
+                            "detail": "fixed_limit 超出范围（1-100）",
+                        })),
+                    )
+                        .into_response(),
+                ));
+            }
+            key.rpm_limit = Some(fixed_limit);
+            format!("已切换为固定限制模式，RPM 限制设为 {fixed_limit}")
+        };
+        let Some(updated) = state.update_provider_catalog_key(&key).await? else {
+            return Ok(Some(admin_adaptive_key_not_found_response(&key_id)));
+        };
+        return Ok(Some(
+            Json(json!({
+                "message": message,
+                "key_id": updated.id,
+                "is_adaptive": updated.rpm_limit.is_none(),
+                "rpm_limit": updated.rpm_limit,
+                "effective_limit": admin_adaptive_effective_limit(&updated),
+            }))
+            .into_response(),
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("set_limit")
+        && request_context.request_method == http::Method::PATCH
+        && request_context.request_path.ends_with("/limit")
+    {
+        let Some(limit_value) =
+            query_param_value(request_context.request_query_string.as_deref(), "limit")
+        else {
+            return Ok(Some(
+                (
+                    http::StatusCode::BAD_REQUEST,
+                    Json(json!({ "detail": "缺少 limit 参数" })),
+                )
+                    .into_response(),
+            ));
+        };
+        let Ok(limit) = limit_value.parse::<u32>() else {
+            return Ok(Some(
+                (
+                    http::StatusCode::BAD_REQUEST,
+                    Json(json!({ "detail": "limit 必须是数字" })),
+                )
+                    .into_response(),
+            ));
+        };
+        if !(1..=100).contains(&limit) {
+            return Ok(Some(
+                (
+                    http::StatusCode::BAD_REQUEST,
+                    Json(json!({ "detail": "limit 超出范围（1-100）" })),
+                )
+                    .into_response(),
+            ));
+        }
+
+        let Some(mut key) = admin_adaptive_find_key(state, &key_id).await? else {
+            return Ok(Some(admin_adaptive_key_not_found_response(&key_id)));
+        };
+        let was_adaptive = key.rpm_limit.is_none();
+        key.rpm_limit = Some(limit);
+        let Some(updated) = state.update_provider_catalog_key(&key).await? else {
+            return Ok(Some(admin_adaptive_key_not_found_response(&key_id)));
+        };
+        return Ok(Some(
+            Json(json!({
+                "message": format!("已设置为固定限制模式，RPM 限制为 {limit}"),
+                "key_id": updated.id,
+                "is_adaptive": false,
+                "rpm_limit": updated.rpm_limit,
+                "previous_mode": if was_adaptive { "adaptive" } else { "fixed" },
+            }))
+            .into_response(),
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("reset_learning")
+        && request_context.request_method == http::Method::DELETE
+        && request_context.request_path.ends_with("/learning")
+    {
+        let Some(mut key) = admin_adaptive_find_key(state, &key_id).await? else {
+            return Ok(Some(admin_adaptive_key_not_found_response(&key_id)));
+        };
+        key.learned_rpm_limit = None;
+        key.concurrent_429_count = None;
+        key.rpm_429_count = None;
+        key.last_429_at_unix_secs = None;
+        key.last_429_type = None;
+        key.adjustment_history = None;
+        let Some(updated) = state.update_provider_catalog_key(&key).await? else {
+            return Ok(Some(admin_adaptive_key_not_found_response(&key_id)));
+        };
+        return Ok(Some(
+            Json(json!({
+                "message": "学习状态已重置",
+                "key_id": updated.id,
+            }))
+            .into_response(),
+        ));
+    }
+
+    Ok(Some(admin_adaptive_dispatcher_not_found_response()))
+}

apps/aether-gateway/src/handlers/admin/system/adaptive/shared.rs

@@ -0,0 +1,117 @@
+use crate::handlers::admin::shared::json_string_list;
+use crate::{AppState, GatewayError};
+use aether_data_contracts::repository::provider_catalog::StoredProviderCatalogKey;
+use axum::{
+    body::Body,
+    http,
+    response::{IntoResponse, Response},
+    Json,
+};
+use serde_json::json;
+
+pub(super) fn admin_adaptive_effective_limit(key: &StoredProviderCatalogKey) -> Option<u32> {
+    if key.rpm_limit.is_none() {
+        key.learned_rpm_limit
+    } else {
+        key.rpm_limit
+    }
+}
+
+pub(super) fn admin_adaptive_adjustment_items(
+    value: Option<&serde_json::Value>,
+) -> Vec<serde_json::Map<String, serde_json::Value>> {
+    value
+        .and_then(serde_json::Value::as_array)
+        .into_iter()
+        .flatten()
+        .filter_map(serde_json::Value::as_object)
+        .cloned()
+        .collect()
+}
+
+pub(super) fn admin_adaptive_key_payload(key: &StoredProviderCatalogKey) -> serde_json::Value {
+    json!({
+        "id": key.id,
+        "name": key.name,
+        "provider_id": key.provider_id,
+        "api_formats": json_string_list(key.api_formats.as_ref()),
+        "is_adaptive": key.rpm_limit.is_none(),
+        "rpm_limit": key.rpm_limit,
+        "effective_limit": admin_adaptive_effective_limit(key),
+        "learned_rpm_limit": key.learned_rpm_limit,
+        "concurrent_429_count": key.concurrent_429_count.unwrap_or(0),
+        "rpm_429_count": key.rpm_429_count.unwrap_or(0),
+    })
+}
+
+pub(super) fn admin_adaptive_key_not_found_response(key_id: &str) -> Response<Body> {
+    (
+        http::StatusCode::NOT_FOUND,
+        Json(json!({ "detail": format!("Key {key_id} 不存在") })),
+    )
+        .into_response()
+}
+
+pub(super) fn admin_adaptive_dispatcher_not_found_response() -> Response<Body> {
+    (
+        http::StatusCode::NOT_FOUND,
+        Json(json!({ "detail": "Adaptive route not found" })),
+    )
+        .into_response()
+}
+
+pub(super) fn admin_adaptive_key_id_from_path(path: &str) -> Option<String> {
+    let normalized = path.trim_end_matches('/');
+    let mut segments = normalized.split('/').filter(|segment| !segment.is_empty());
+    match (
+        segments.next(),
+        segments.next(),
+        segments.next(),
+        segments.next(),
+        segments.next(),
+    ) {
+        (Some("api"), Some("admin"), Some("adaptive"), Some("keys"), Some(key_id))
+            if !key_id.is_empty() =>
+        {
+            Some(key_id.to_string())
+        }
+        _ => None,
+    }
+}
+
+pub(super) async fn admin_adaptive_find_key(
+    state: &AppState,
+    key_id: &str,
+) -> Result<Option<StoredProviderCatalogKey>, GatewayError> {
+    Ok(state
+        .read_provider_catalog_keys_by_ids(std::slice::from_ref(&key_id.to_string()))
+        .await?
+        .into_iter()
+        .next())
+}
+
+pub(super) async fn admin_adaptive_load_candidate_keys(
+    state: &AppState,
+    provider_id: Option<&str>,
+) -> Result<Vec<StoredProviderCatalogKey>, GatewayError> {
+    if let Some(provider_id) = provider_id.filter(|value| !value.trim().is_empty()) {
+        return state
+            .list_provider_catalog_keys_by_provider_ids(std::slice::from_ref(
+                &provider_id.to_string(),
+            ))
+            .await;
+    }
+
+    let provider_ids = state
+        .list_provider_catalog_providers(false)
+        .await?
+        .into_iter()
+        .map(|provider| provider.id)
+        .collect::<Vec<_>>();
+    if provider_ids.is_empty() {
+        return Ok(vec![]);
+    }
+    state
+        .list_provider_catalog_keys_by_provider_ids(&provider_ids)
+        .await
+}

apps/aether-gateway/src/handlers/admin/system/core/management_tokens_routes.rs

@@ -0,0 +1 @@
+pub(super) use crate::handlers::admin::system::maybe_build_local_admin_management_tokens_response as maybe_build_local_admin_core_management_tokens_response;

apps/aether-gateway/src/handlers/admin/system/core/mod.rs

@@ -0,0 +1,94 @@
+use crate::control::GatewayPublicRequestContext;
+use crate::{AppState, GatewayError};
+use axum::{
+    body::{Body, Bytes},
+    http,
+    response::Response,
+};
+
+const ADMIN_AWS_REGIONS: &[&str] = &[
+    "af-south-1",
+    "ap-east-1",
+    "ap-northeast-1",
+    "ap-northeast-2",
+    "ap-northeast-3",
+    "ap-south-1",
+    "ap-south-2",
+    "ap-southeast-1",
+    "ap-southeast-2",
+    "ap-southeast-3",
+    "ap-southeast-4",
+    "ca-central-1",
+    "ca-west-1",
+    "eu-central-1",
+    "eu-central-2",
+    "eu-north-1",
+    "eu-south-1",
+    "eu-south-2",
+    "eu-west-1",
+    "eu-west-2",
+    "eu-west-3",
+    "il-central-1",
+    "me-central-1",
+    "me-south-1",
+    "sa-east-1",
+    "us-east-1",
+    "us-east-2",
+    "us-west-1",
+    "us-west-2",
+];
+mod management_tokens_routes;
+mod model_routes;
+mod modules_routes;
+mod oauth_routes;
+mod system_routes;
+
+pub(crate) async fn maybe_build_local_admin_core_response(
+    state: &AppState,
+    request_context: &GatewayPublicRequestContext,
+    request_body: Option<&Bytes>,
+) -> Result<Option<Response<Body>>, GatewayError> {
+    if let Some(response) =
+        management_tokens_routes::maybe_build_local_admin_core_management_tokens_response(
+            state,
+            request_context,
+        )
+        .await?
+    {
+        return Ok(Some(response));
+    }
+    if let Some(response) = oauth_routes::maybe_build_local_admin_core_oauth_response(
+        state,
+        request_context,
+        request_body,
+    )
+    .await?
+    {
+        return Ok(Some(response));
+    }
+    if let Some(response) = modules_routes::maybe_build_local_admin_core_modules_response(
+        state,
+        request_context,
+        request_body,
+    )
+    .await?
+    {
+        return Ok(Some(response));
+    }
+    if let Some(response) = system_routes::maybe_build_local_admin_core_system_response(
+        state,
+        request_context,
+        request_body,
+    )
+    .await?
+    {
+        return Ok(Some(response));
+    }
+    if let Some(response) =
+        model_routes::maybe_build_local_admin_core_model_response(state, request_context).await?
+    {
+        return Ok(Some(response));
+    }
+
+    Ok(None)
+}

apps/aether-gateway/src/handlers/admin/system/core/model_routes.rs

@@ -0,0 +1 @@
+pub(super) use crate::handlers::admin::model::maybe_build_local_admin_model_catalog_response as maybe_build_local_admin_core_model_response;

apps/aether-gateway/src/handlers/admin/system/core/modules_routes.rs

@@ -0,0 +1 @@
+pub(super) use crate::handlers::admin::system::maybe_build_local_admin_modules_response as maybe_build_local_admin_core_modules_response;

apps/aether-gateway/src/handlers/admin/system/core/oauth_routes.rs

@@ -0,0 +1 @@
+pub(super) use crate::handlers::admin::auth::maybe_build_local_admin_oauth_response as maybe_build_local_admin_core_oauth_response;

apps/aether-gateway/src/handlers/admin/system/core/system_routes.rs

@@ -0,0 +1,365 @@
+use super::ADMIN_AWS_REGIONS;
+use crate::control::GatewayPublicRequestContext;
+use crate::handlers::admin::auth::build_proxy_error_response;
+use crate::handlers::admin::shared::attach_admin_audit_response;
+use crate::handlers::admin::system::shared::{
+    apply_admin_system_config_update, apply_admin_system_settings_update,
+    admin_system_config_key_from_path, admin_system_email_template_preview_type_from_path,
+    admin_system_email_template_reset_type_from_path, admin_system_email_template_type_from_path,
+    build_admin_api_formats_payload, build_admin_system_check_update_payload,
+    build_admin_system_config_detail_payload, build_admin_system_config_export_payload,
+    build_admin_system_configs_payload, build_admin_system_settings_payload,
+    build_admin_system_stats_payload, build_admin_system_users_export_payload,
+    current_aether_version, delete_admin_system_config, is_admin_system_configs_root,
+    is_admin_system_email_templates_root,
+};
+use crate::handlers::public::{
+    build_admin_email_template_payload, build_admin_email_templates_payload,
+    preview_admin_email_template, reset_admin_email_template,
+};
+use crate::{AppState, GatewayError};
+use axum::{
+    body::{Body, Bytes},
+    http,
+    response::{IntoResponse, Response},
+    Json,
+};
+use serde_json::json;
+
+pub(super) async fn maybe_build_local_admin_core_system_response(
+    state: &AppState,
+    request_context: &GatewayPublicRequestContext,
+    request_body: Option<&Bytes>,
+) -> Result<Option<Response<Body>>, GatewayError> {
+    let Some(decision) = request_context.control_decision.as_ref() else {
+        return Ok(None);
+    };
+    if decision.route_family.as_deref() != Some("system_manage") {
+        return Ok(None);
+    }
+
+    if decision.route_kind.as_deref() == Some("version")
+        && request_context.request_method == http::Method::GET
+        && request_context.request_path == "/api/admin/system/version"
+    {
+        return Ok(Some(
+            Json(json!({ "version": current_aether_version() })).into_response(),
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("check_update")
+        && request_context.request_method == http::Method::GET
+        && request_context.request_path == "/api/admin/system/check-update"
+    {
+        return Ok(Some(
+            Json(build_admin_system_check_update_payload()).into_response(),
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("aws_regions")
+        && request_context.request_method == http::Method::GET
+        && request_context.request_path == "/api/admin/system/aws-regions"
+    {
+        return Ok(Some(
+            Json(json!({ "regions": ADMIN_AWS_REGIONS })).into_response(),
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("stats")
+        && request_context.request_method == http::Method::GET
+        && request_context.request_path == "/api/admin/system/stats"
+    {
+        return Ok(Some(
+            Json(build_admin_system_stats_payload(state).await?).into_response(),
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("settings_get")
+        && request_context.request_method == http::Method::GET
+        && request_context.request_path == "/api/admin/system/settings"
+    {
+        return Ok(Some(
+            Json(build_admin_system_settings_payload(state).await?).into_response(),
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("config_export")
+        && request_context.request_method == http::Method::GET
+        && request_context.request_path == "/api/admin/system/config/export"
+    {
+        return Ok(Some(attach_admin_audit_response(
+            Json(build_admin_system_config_export_payload(state).await?).into_response(),
+            "admin_system_config_exported",
+            "export_system_config",
+            "system_config_export",
+            "global",
+        )));
+    }
+
+    if decision.route_kind.as_deref() == Some("users_export")
+        && request_context.request_method == http::Method::GET
+        && request_context.request_path == "/api/admin/system/users/export"
+    {
+        return Ok(Some(attach_admin_audit_response(
+            Json(build_admin_system_users_export_payload(state).await?).into_response(),
+            "admin_system_users_exported",
+            "export_system_users",
+            "user_export",
+            "all_users",
+        )));
+    }
+
+    if matches!(
+        decision.route_kind.as_deref(),
+        Some(
+            "config_import"
+                | "users_import"
+                | "smtp_test"
+                | "cleanup"
+                | "purge_config"
+                | "purge_users"
+                | "purge_usage"
+                | "purge_audit_logs"
+                | "purge_request_bodies"
+                | "purge_stats"
+        )
+    ) && request_context.request_method == http::Method::POST
+    {
+        return Ok(Some(
+            (
+                http::StatusCode::SERVICE_UNAVAILABLE,
+                Json(json!({ "detail": "Admin system data unavailable" })),
+            )
+                .into_response(),
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("settings_set")
+        && request_context.request_method == http::Method::PUT
+        && request_context.request_path == "/api/admin/system/settings"
+    {
+        let Some(request_body) = request_body else {
+            return Ok(Some(
+                (
+                    http::StatusCode::BAD_REQUEST,
+                    Json(json!({ "detail": "请求数据验证失败" })),
+                )
+                    .into_response(),
+            ));
+        };
+        return Ok(Some(
+            match apply_admin_system_settings_update(state, request_body).await? {
+                Ok(payload) => attach_admin_audit_response(
+                    Json(payload).into_response(),
+                    "admin_system_settings_updated",
+                    "update_system_settings",
+                    "system_settings",
+                    "global",
+                ),
+                Err((status, payload)) => (status, Json(payload)).into_response(),
+            },
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("configs_list")
+        && request_context.request_method == http::Method::GET
+        && is_admin_system_configs_root(&request_context.request_path)
+    {
+        let entries = state.list_system_config_entries().await?;
+        return Ok(Some(
+            Json(build_admin_system_configs_payload(&entries)).into_response(),
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("config_get")
+        && request_context.request_method == http::Method::GET
+    {
+        let Some(config_key) = admin_system_config_key_from_path(&request_context.request_path)
+        else {
+            return Ok(Some(build_proxy_error_response(
+                http::StatusCode::NOT_FOUND,
+                "not_found",
+                "配置项不存在",
+                None,
+            )));
+        };
+        return Ok(Some(
+            match build_admin_system_config_detail_payload(state, &config_key).await? {
+                Ok(payload) => Json(payload).into_response(),
+                Err((status, payload)) => (status, Json(payload)).into_response(),
+            },
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("config_set")
+        && request_context.request_method == http::Method::PUT
+    {
+        let Some(config_key) = admin_system_config_key_from_path(&request_context.request_path)
+        else {
+            return Ok(Some(build_proxy_error_response(
+                http::StatusCode::NOT_FOUND,
+                "not_found",
+                "配置项不存在",
+                None,
+            )));
+        };
+        let Some(request_body) = request_body else {
+            return Ok(Some(build_proxy_error_response(
+                http::StatusCode::BAD_REQUEST,
+                "invalid_request",
+                "请求数据验证失败",
+                None,
+            )));
+        };
+        return Ok(Some(
+            match apply_admin_system_config_update(state, &config_key, request_body).await? {
+                Ok(payload) => attach_admin_audit_response(
+                    Json(payload).into_response(),
+                    "admin_system_config_updated",
+                    "update_system_config",
+                    "system_config",
+                    &config_key,
+                ),
+                Err((status, payload)) => (status, Json(payload)).into_response(),
+            },
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("config_delete")
+        && request_context.request_method == http::Method::DELETE
+    {
+        let Some(config_key) = admin_system_config_key_from_path(&request_context.request_path)
+        else {
+            return Ok(Some(build_proxy_error_response(
+                http::StatusCode::NOT_FOUND,
+                "not_found",
+                "配置项不存在",
+                None,
+            )));
+        };
+        return Ok(Some(
+            match delete_admin_system_config(state, &config_key).await? {
+                Ok(payload) => attach_admin_audit_response(
+                    Json(payload).into_response(),
+                    "admin_system_config_deleted",
+                    "delete_system_config",
+                    "system_config",
+                    &config_key,
+                ),
+                Err((status, payload)) => (status, Json(payload)).into_response(),
+            },
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("api_formats")
+        && request_context.request_method == http::Method::GET
+        && request_context.request_path == "/api/admin/system/api-formats"
+    {
+        return Ok(Some(
+            Json(build_admin_api_formats_payload()).into_response(),
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("email_templates_list")
+        && request_context.request_method == http::Method::GET
+        && is_admin_system_email_templates_root(&request_context.request_path)
+    {
+        return Ok(Some(
+            Json(build_admin_email_templates_payload(state).await?).into_response(),
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("email_template_get")
+        && request_context.request_method == http::Method::GET
+    {
+        let Some(template_type) =
+            admin_system_email_template_type_from_path(&request_context.request_path)
+        else {
+            return Ok(Some(build_proxy_error_response(
+                http::StatusCode::NOT_FOUND,
+                "not_found",
+                "模板类型不存在",
+                None,
+            )));
+        };
+        return Ok(Some(
+            match build_admin_email_template_payload(state, &template_type).await? {
+                Ok(payload) => Json(payload).into_response(),
+                Err((status, payload)) => (status, Json(payload)).into_response(),
+            },
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("email_template_set")
+        && request_context.request_method == http::Method::PUT
+    {
+        let Some(template_type) =
+            admin_system_email_template_type_from_path(&request_context.request_path)
+        else {
+            return Ok(Some(build_proxy_error_response(
+                http::StatusCode::NOT_FOUND,
+                "not_found",
+                "模板类型不存在",
+                None,
+            )));
+        };
+        let Some(request_body) = request_body else {
+            return Ok(Some(build_proxy_error_response(
+                http::StatusCode::BAD_REQUEST,
+                "invalid_request",
+                "请求数据验证失败",
+                None,
+            )));
+        };
+        return Ok(Some(
+            match apply_admin_email_template_update(state, &template_type, request_body).await? {
+                Ok(payload) => Json(payload).into_response(),
+                Err((status, payload)) => (status, Json(payload)).into_response(),
+            },
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("email_template_preview")
+        && request_context.request_method == http::Method::POST
+    {
+        let Some(template_type) =
+            admin_system_email_template_preview_type_from_path(&request_context.request_path)
+        else {
+            return Ok(Some(build_proxy_error_response(
+                http::StatusCode::NOT_FOUND,
+                "not_found",
+                "模板类型不存在",
+                None,
+            )));
+        };
+        return Ok(Some(
+            match preview_admin_email_template(state, &template_type, request_body).await? {
+                Ok(payload) => Json(payload).into_response(),
+                Err((status, payload)) => (status, Json(payload)).into_response(),
+            },
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("email_template_reset")
+        && request_context.request_method == http::Method::POST
+    {
+        let Some(template_type) =
+            admin_system_email_template_reset_type_from_path(&request_context.request_path)
+        else {
+            return Ok(Some(build_proxy_error_response(
+                http::StatusCode::NOT_FOUND,
+                "not_found",
+                "模板类型不存在",
+                None,
+            )));
+        };
+        return Ok(Some(
+            match reset_admin_email_template(state, &template_type).await? {
+                Ok(payload) => Json(payload).into_response(),
+                Err((status, payload)) => (status, Json(payload)).into_response(),
+            },
+        ));
+    }
+
+    Ok(None)
+}

apps/aether-gateway/src/handlers/admin/system/management_tokens.rs

@@ -0,0 +1,210 @@
+use crate::control::GatewayPublicRequestContext;
+use crate::handlers::admin::shared::{query_param_optional_bool, query_param_value};
+use crate::handlers::admin::system::shared::{
+    admin_management_token_id_from_path, admin_management_token_status_id_from_path,
+    is_admin_management_tokens_root,
+};
+use crate::handlers::internal::build_management_token_payload;
+use crate::{AppState, GatewayError};
+use aether_data::repository::management_tokens::ManagementTokenListQuery;
+use axum::{
+    body::Body,
+    http,
+    response::{IntoResponse, Response},
+    Json,
+};
+use serde_json::json;
+
+pub(crate) async fn maybe_build_local_admin_management_tokens_response(
+    state: &AppState,
+    request_context: &GatewayPublicRequestContext,
+) -> Result<Option<Response<Body>>, GatewayError> {
+    let Some(decision) = request_context.control_decision.as_ref() else {
+        return Ok(None);
+    };
+    if decision.route_family.as_deref() != Some("management_tokens_manage") {
+        return Ok(None);
+    }
+
+    if decision
+        .admin_principal
+        .as_ref()
+        .and_then(|principal| principal.management_token_id.as_deref())
+        .is_some()
+    {
+        return Ok(Some(
+            (
+                http::StatusCode::FORBIDDEN,
+                Json(json!({
+                    "detail": "不允许使用 Management Token 管理其他 Token，请使用 Web 界面或 JWT 认证"
+                })),
+            )
+                .into_response(),
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("list_tokens")
+        && request_context.request_method == http::Method::GET
+        && is_admin_management_tokens_root(&request_context.request_path)
+    {
+        if !state.has_management_token_reader() {
+            return Ok(None);
+        }
+        let user_id = query_param_value(request_context.request_query_string.as_deref(), "user_id");
+        let is_active =
+            query_param_optional_bool(request_context.request_query_string.as_deref(), "is_active");
+        let skip = query_param_value(request_context.request_query_string.as_deref(), "skip")
+            .and_then(|value| value.parse::<usize>().ok())
+            .unwrap_or(0);
+        let limit = query_param_value(request_context.request_query_string.as_deref(), "limit")
+            .and_then(|value| value.parse::<usize>().ok())
+            .filter(|value| *value > 0 && *value <= 100)
+            .unwrap_or(50);
+        let page = state
+            .list_management_tokens(&ManagementTokenListQuery {
+                user_id,
+                is_active,
+                offset: skip,
+                limit,
+            })
+            .await?;
+        let items = page
+            .items
+            .iter()
+            .map(|item| build_management_token_payload(&item.token, Some(&item.user)))
+            .collect::<Vec<_>>();
+        return Ok(Some(
+            Json(json!({
+                "items": items,
+                "total": page.total,
+                "skip": skip,
+                "limit": limit,
+            }))
+            .into_response(),
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("get_token")
+        && request_context.request_method == http::Method::GET
+    {
+        if !state.has_management_token_reader() {
+            return Ok(None);
+        }
+        let Some(token_id) = admin_management_token_id_from_path(&request_context.request_path)
+        else {
+            return Ok(Some(
+                (
+                    http::StatusCode::NOT_FOUND,
+                    Json(json!({ "detail": "Management Token 不存在" })),
+                )
+                    .into_response(),
+            ));
+        };
+        return Ok(Some(
+            match state.get_management_token_with_user(&token_id).await? {
+                Some(token) => Json(build_management_token_payload(
+                    &token.token,
+                    Some(&token.user),
+                ))
+                .into_response(),
+                None => (
+                    http::StatusCode::NOT_FOUND,
+                    Json(json!({ "detail": "Management Token 不存在" })),
+                )
+                    .into_response(),
+            },
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("delete_token")
+        && request_context.request_method == http::Method::DELETE
+    {
+        if !state.has_management_token_writer() {
+            return Ok(None);
+        }
+        let Some(token_id) = admin_management_token_id_from_path(&request_context.request_path)
+        else {
+            return Ok(Some(
+                (
+                    http::StatusCode::NOT_FOUND,
+                    Json(json!({ "detail": "Management Token 不存在" })),
+                )
+                    .into_response(),
+            ));
+        };
+        let existing = match state.get_management_token_with_user(&token_id).await? {
+            Some(token) => token,
+            None => {
+                return Ok(Some(
+                    (
+                        http::StatusCode::NOT_FOUND,
+                        Json(json!({ "detail": "Management Token 不存在" })),
+                    )
+                        .into_response(),
+                ));
+            }
+        };
+        let deleted = state.delete_management_token(&existing.token.id).await?;
+        return Ok(Some(if deleted {
+            Json(json!({ "message": "删除成功" })).into_response()
+        } else {
+            (
+                http::StatusCode::NOT_FOUND,
+                Json(json!({ "detail": "Management Token 不存在" })),
+            )
+                .into_response()
+        }));
+    }
+
+    if decision.route_kind.as_deref() == Some("toggle_status")
+        && request_context.request_method == http::Method::PATCH
+    {
+        if !state.has_management_token_writer() {
+            return Ok(None);
+        }
+        let Some(token_id) =
+            admin_management_token_status_id_from_path(&request_context.request_path)
+        else {
+            return Ok(Some(
+                (
+                    http::StatusCode::NOT_FOUND,
+                    Json(json!({ "detail": "Management Token 不存在" })),
+                )
+                    .into_response(),
+            ));
+        };
+        let existing = match state.get_management_token_with_user(&token_id).await? {
+            Some(token) => token,
+            None => {
+                return Ok(Some(
+                    (
+                        http::StatusCode::NOT_FOUND,
+                        Json(json!({ "detail": "Management Token 不存在" })),
+                    )
+                        .into_response(),
+                ));
+            }
+        };
+        let Some(updated) = state
+            .set_management_token_active(&existing.token.id, !existing.token.is_active)
+            .await?
+        else {
+            return Ok(Some(
+                (
+                    http::StatusCode::NOT_FOUND,
+                    Json(json!({ "detail": "Management Token 不存在" })),
+                )
+                    .into_response(),
+            ));
+        };
+        return Ok(Some(
+            Json(json!({
+                "message": format!("Token 已{}", if updated.is_active { "启用" } else { "禁用" }),
+                "data": build_management_token_payload(&updated, Some(&existing.user)),
+            }))
+            .into_response(),
+        ));
+    }
+
+    Ok(None)
+}

apps/aether-gateway/src/handlers/admin/system/mod.rs

@@ -0,0 +1,14 @@
+mod adaptive;
+mod core;
+mod management_tokens;
+mod modules;
+mod pool;
+mod proxy_nodes;
+pub(crate) mod shared;
+
+pub(crate) use self::adaptive::maybe_build_local_admin_adaptive_response;
+pub(crate) use self::core::maybe_build_local_admin_core_response;
+pub(crate) use self::management_tokens::maybe_build_local_admin_management_tokens_response;
+pub(crate) use self::modules::maybe_build_local_admin_modules_response;
+pub(crate) use self::pool::maybe_build_local_admin_pool_response;
+pub(crate) use self::proxy_nodes::maybe_build_local_admin_proxy_nodes_response;

apps/aether-gateway/src/handlers/admin/system/modules.rs

@@ -0,0 +1,162 @@
+use crate::control::GatewayPublicRequestContext;
+use crate::handlers::admin::system::shared::{
+    admin_module_by_name, admin_module_name_from_enabled_path, admin_module_name_from_status_path,
+    build_admin_module_runtime_state, build_admin_module_status_payload,
+    build_admin_module_validation_result, build_admin_modules_status_payload,
+    AdminSetModuleEnabledRequest,
+};
+use crate::handlers::public::module_available_from_env;
+use crate::{AppState, GatewayError};
+use axum::{
+    body::{Body, Bytes},
+    http,
+    response::{IntoResponse, Response},
+    Json,
+};
+use serde_json::json;
+
+pub(crate) async fn maybe_build_local_admin_modules_response(
+    state: &AppState,
+    request_context: &GatewayPublicRequestContext,
+    request_body: Option<&Bytes>,
+) -> Result<Option<Response<Body>>, GatewayError> {
+    let Some(decision) = request_context.control_decision.as_ref() else {
+        return Ok(None);
+    };
+    if decision.route_family.as_deref() != Some("modules_manage") {
+        return Ok(None);
+    }
+
+    if decision.route_kind.as_deref() == Some("status_list")
+        && request_context.request_method == http::Method::GET
+        && request_context.request_path == "/api/admin/modules/status"
+    {
+        let payload = build_admin_modules_status_payload(state).await?;
+        return Ok(Some(Json(payload).into_response()));
+    }
+
+    if decision.route_kind.as_deref() == Some("status_detail")
+        && request_context.request_method == http::Method::GET
+        && request_context
+            .request_path
+            .starts_with("/api/admin/modules/status/")
+    {
+        let Some(module_name) = admin_module_name_from_status_path(&request_context.request_path)
+        else {
+            return Ok(Some(
+                (
+                    http::StatusCode::NOT_FOUND,
+                    Json(json!({ "detail": "模块不存在" })),
+                )
+                    .into_response(),
+            ));
+        };
+        let Some(module) = admin_module_by_name(&module_name) else {
+            return Ok(Some(
+                (
+                    http::StatusCode::NOT_FOUND,
+                    Json(json!({ "detail": format!("模块 '{module_name}' 不存在") })),
+                )
+                    .into_response(),
+            ));
+        };
+        let runtime = build_admin_module_runtime_state(state).await?;
+        let payload = build_admin_module_status_payload(state, module, &runtime).await?;
+        return Ok(Some(Json(payload).into_response()));
+    }
+
+    if decision.route_kind.as_deref() == Some("set_enabled")
+        && request_context.request_method == http::Method::PUT
+        && request_context
+            .request_path
+            .starts_with("/api/admin/modules/status/")
+        && request_context.request_path.ends_with("/enabled")
+    {
+        let Some(module_name) = admin_module_name_from_enabled_path(&request_context.request_path)
+        else {
+            return Ok(Some(
+                (
+                    http::StatusCode::NOT_FOUND,
+                    Json(json!({ "detail": "模块不存在" })),
+                )
+                    .into_response(),
+            ));
+        };
+        let Some(module) = admin_module_by_name(&module_name) else {
+            return Ok(Some(
+                (
+                    http::StatusCode::NOT_FOUND,
+                    Json(json!({ "detail": format!("模块 '{module_name}' 不存在") })),
+                )
+                    .into_response(),
+            ));
+        };
+        let available = module_available_from_env(module.env_key, module.default_available);
+        if !available {
+            return Ok(Some(
+                (
+                    http::StatusCode::BAD_REQUEST,
+                    Json(json!({
+                        "detail": format!(
+                            "模块 '{}' 不可用，无法启用。请检查环境变量 {} 和依赖库。",
+                            module.name, module.env_key
+                        )
+                    })),
+                )
+                    .into_response(),
+            ));
+        }
+        let Some(request_body) = request_body else {
+            return Ok(Some(
+                (
+                    http::StatusCode::BAD_REQUEST,
+                    Json(json!({ "detail": "请求体不能为空" })),
+                )
+                    .into_response(),
+            ));
+        };
+        let payload = match serde_json::from_slice::<AdminSetModuleEnabledRequest>(request_body) {
+            Ok(payload) => payload,
+            Err(_) => {
+                return Ok(Some(
+                    (
+                        http::StatusCode::BAD_REQUEST,
+                        Json(json!({ "detail": "请求体格式错误，需要 enabled 字段" })),
+                    )
+                        .into_response(),
+                ));
+            }
+        };
+        let runtime = build_admin_module_runtime_state(state).await?;
+        if payload.enabled {
+            let (config_validated, config_error) =
+                build_admin_module_validation_result(module, &runtime);
+            if !config_validated {
+                return Ok(Some(
+                    (
+                        http::StatusCode::BAD_REQUEST,
+                        Json(json!({
+                            "detail": format!(
+                                "模块配置未验证通过: {}",
+                                config_error.unwrap_or_else(|| "未知错误".to_string())
+                            )
+                        })),
+                    )
+                        .into_response(),
+                ));
+            }
+        }
+        let _ = state
+            .upsert_system_config_json_value(
+                &format!("module.{}.enabled", module.name),
+                &json!(payload.enabled),
+                Some(&format!("模块 [{}] 启用状态", module.display_name)),
+            )
+            .await?;
+        let updated_runtime = build_admin_module_runtime_state(state).await?;
+        let payload = build_admin_module_status_payload(state, module, &updated_runtime).await?;
+        return Ok(Some(Json(payload).into_response()));
+    }
+
+    Ok(None)
+}

apps/aether-gateway/src/handlers/admin/system/pool/mod.rs

@@ -0,0 +1 @@
+pub(crate) use crate::handlers::admin::provider::pool_admin::maybe_build_local_admin_pool_response;

apps/aether-gateway/src/handlers/admin/system/proxy_nodes.rs

@@ -0,0 +1,247 @@
+use crate::control::GatewayPublicRequestContext;
+use crate::handlers::admin::shared::{query_param_value, unix_secs_to_rfc3339};
+use crate::{AppState, GatewayError};
+use aether_data::repository::proxy_nodes::{StoredProxyNode, StoredProxyNodeEvent};
+use axum::{
+    body::Body,
+    http,
+    response::{IntoResponse, Response},
+    Json,
+};
+use serde_json::json;
+
+const ADMIN_PROXY_NODES_DATA_UNAVAILABLE_DETAIL: &str = "Admin proxy nodes data unavailable";
+
+fn build_admin_proxy_nodes_data_unavailable_response() -> Response<Body> {
+    (
+        http::StatusCode::SERVICE_UNAVAILABLE,
+        Json(json!({ "detail": ADMIN_PROXY_NODES_DATA_UNAVAILABLE_DETAIL })),
+    )
+        .into_response()
+}
+
+fn mask_admin_proxy_node_password(password: Option<&str>) -> Option<String> {
+    let password = password?;
+    if password.is_empty() {
+        return None;
+    }
+    if password.len() < 8 {
+        return Some("****".to_string());
+    }
+    Some(format!(
+        "{}****{}",
+        &password[..2],
+        &password[password.len() - 2..]
+    ))
+}
+
+fn build_admin_proxy_node_payload(node: &StoredProxyNode) -> serde_json::Value {
+    let mut payload = serde_json::Map::from_iter([
+        ("id".to_string(), json!(node.id)),
+        ("name".to_string(), json!(node.name)),
+        ("ip".to_string(), json!(node.ip)),
+        ("port".to_string(), json!(node.port)),
+        ("region".to_string(), json!(node.region)),
+        ("status".to_string(), json!(node.status)),
+        ("is_manual".to_string(), json!(node.is_manual)),
+        ("tunnel_mode".to_string(), json!(node.tunnel_mode)),
+        ("tunnel_connected".to_string(), json!(node.tunnel_connected)),
+        (
+            "tunnel_connected_at".to_string(),
+            json!(node
+                .tunnel_connected_at_unix_secs
+                .and_then(unix_secs_to_rfc3339)),
+        ),
+        ("registered_by".to_string(), json!(node.registered_by)),
+        (
+            "last_heartbeat_at".to_string(),
+            json!(node
+                .last_heartbeat_at_unix_secs
+                .and_then(unix_secs_to_rfc3339)),
+        ),
+        (
+            "heartbeat_interval".to_string(),
+            json!(node.heartbeat_interval),
+        ),
+        (
+            "active_connections".to_string(),
+            json!(node.active_connections),
+        ),
+        ("total_requests".to_string(), json!(node.total_requests)),
+        ("avg_latency_ms".to_string(), json!(node.avg_latency_ms)),
+        ("failed_requests".to_string(), json!(node.failed_requests)),
+        ("dns_failures".to_string(), json!(node.dns_failures)),
+        ("stream_errors".to_string(), json!(node.stream_errors)),
+        ("proxy_metadata".to_string(), json!(node.proxy_metadata)),
+        ("hardware_info".to_string(), json!(node.hardware_info)),
+        (
+            "estimated_max_concurrency".to_string(),
+            json!(node.estimated_max_concurrency),
+        ),
+        ("remote_config".to_string(), json!(node.remote_config)),
+        ("config_version".to_string(), json!(node.config_version)),
+        (
+            "created_at".to_string(),
+            json!(node.created_at_unix_secs.and_then(unix_secs_to_rfc3339)),
+        ),
+        (
+            "updated_at".to_string(),
+            json!(node.updated_at_unix_secs.and_then(unix_secs_to_rfc3339)),
+        ),
+    ]);
+
+    if node.is_manual {
+        payload.insert("proxy_url".to_string(), json!(node.proxy_url));
+        payload.insert("proxy_username".to_string(), json!(node.proxy_username));
+        payload.insert(
+            "proxy_password".to_string(),
+            json!(mask_admin_proxy_node_password(
+                node.proxy_password.as_deref()
+            )),
+        );
+    }
+
+    serde_json::Value::Object(payload)
+}
+
+fn build_admin_proxy_node_event_payload(event: &StoredProxyNodeEvent) -> serde_json::Value {
+    json!({
+        "id": event.id,
+        "event_type": event.event_type,
+        "detail": event.detail,
+        "created_at": event.created_at_unix_secs.and_then(unix_secs_to_rfc3339),
+    })
+}
+
+fn admin_proxy_node_event_node_id_from_path(request_path: &str) -> Option<&str> {
+    let node_id = request_path.strip_prefix("/api/admin/proxy-nodes/")?;
+    let node_id = node_id.strip_suffix("/events")?;
+    if node_id.is_empty() || node_id.contains('/') {
+        return None;
+    }
+    Some(node_id)
+}
+
+pub(crate) async fn maybe_build_local_admin_proxy_nodes_response(
+    state: &AppState,
+    request_context: &GatewayPublicRequestContext,
+) -> Result<Option<Response<Body>>, GatewayError> {
+    let Some(decision) = request_context.control_decision.as_ref() else {
+        return Ok(None);
+    };
+
+    if decision.route_family.as_deref() != Some("proxy_nodes_manage") {
+        return Ok(None);
+    }
+
+    if decision.route_kind.as_deref() == Some("list_nodes")
+        && request_context.request_method == http::Method::GET
+        && matches!(
+            request_context.request_path.as_str(),
+            "/api/admin/proxy-nodes" | "/api/admin/proxy-nodes/"
+        )
+    {
+        if !state.data.has_proxy_node_reader() {
+            return Ok(Some(build_admin_proxy_nodes_data_unavailable_response()));
+        }
+
+        let skip = query_param_value(request_context.request_query_string.as_deref(), "skip")
+            .and_then(|value| value.parse::<usize>().ok())
+            .unwrap_or(0);
+        let limit = query_param_value(request_context.request_query_string.as_deref(), "limit")
+            .and_then(|value| value.parse::<usize>().ok())
+            .filter(|value| *value > 0 && *value <= 1000)
+            .unwrap_or(100);
+        let status = query_param_value(request_context.request_query_string.as_deref(), "status")
+            .map(|value| value.trim().to_ascii_lowercase())
+            .filter(|value| !value.is_empty());
+
+        if let Some(status) = status.as_deref() {
+            if !matches!(status, "offline" | "online") {
+                return Ok(Some(
+                    (
+                        http::StatusCode::BAD_REQUEST,
+                        Json(json!({
+                            "detail": "status 必须是以下之一: ['offline', 'online']"
+                        })),
+                    )
+                        .into_response(),
+                ));
+            }
+        }
+
+        let mut nodes = state.list_proxy_nodes().await?;
+        nodes.sort_by(|left, right| left.name.cmp(&right.name));
+
+        let filtered = nodes
+            .into_iter()
+            .filter(|node| {
+                status
+                    .as_deref()
+                    .map(|value| node.status.eq_ignore_ascii_case(value))
+                    .unwrap_or(true)
+            })
+            .collect::<Vec<_>>();
+        let total = filtered.len();
+        let items = filtered
+            .into_iter()
+            .skip(skip)
+            .take(limit)
+            .map(|node| build_admin_proxy_node_payload(&node))
+            .collect::<Vec<_>>();
+
+        return Ok(Some(
+            Json(json!({
+                "items": items,
+                "total": total,
+                "skip": skip,
+                "limit": limit,
+            }))
+            .into_response(),
+        ));
+    }
+
+    if decision.route_kind.as_deref() == Some("list_node_events")
+        && request_context.request_method == http::Method::GET
+    {
+        if !state.data.has_proxy_node_reader() {
+            return Ok(Some(build_admin_proxy_nodes_data_unavailable_response()));
+        }
+
+        let Some(node_id) = admin_proxy_node_event_node_id_from_path(&request_context.request_path)
+        else {
+            return Ok(Some(
+                (
+                    http::StatusCode::NOT_FOUND,
+                    Json(json!({ "detail": "Proxy node 不存在" })),
+                )
+                    .into_response(),
+            ));
+        };
+
+        if state.find_proxy_node(node_id).await?.is_none() {
+            return Ok(Some(
+                (
+                    http::StatusCode::NOT_FOUND,
+                    Json(json!({ "detail": "Proxy node 不存在" })),
+                )
+                    .into_response(),
+            ));
+        }
+
+        let limit = query_param_value(request_context.request_query_string.as_deref(), "limit")
+            .and_then(|value| value.parse::<usize>().ok())
+            .filter(|value| *value > 0 && *value <= 200)
+            .unwrap_or(50);
+        let items = state
+            .list_proxy_node_events(node_id, limit)
+            .await?
+            .into_iter()
+            .map(|event| build_admin_proxy_node_event_payload(&event))
+            .collect::<Vec<_>>();
+
+        return Ok(Some(Json(json!({ "items": items })).into_response()));
+    }
+
+    Ok(Some(build_admin_proxy_nodes_data_unavailable_response()))
+}

apps/aether-gateway/src/handlers/admin/system/shared/configs.rs

@@ -0,0 +1,879 @@
+use crate::api::ai::admin_endpoint_signature_parts;
+use crate::handlers::shared::{decrypt_catalog_secret_with_fallbacks, unix_secs_to_rfc3339};
+use crate::{AppState, GatewayError};
+use aether_crypto::encrypt_python_fernet_plaintext;
+use aether_data_contracts::repository::global_models::{
+    AdminGlobalModelListQuery, AdminProviderModelListQuery,
+};
+use aether_data_contracts::repository::provider_catalog::StoredProviderCatalogEndpoint;
+use axum::body::Bytes;
+use axum::http;
+use chrono::Utc;
+use serde_json::json;
+use std::collections::{BTreeMap, BTreeSet};
+
+const ADMIN_SYSTEM_CONFIG_EXPORT_VERSION: &str = "2.2";
+const ADMIN_SYSTEM_EXPORT_PAGE_LIMIT: usize = 10_000;
+const PROVIDER_OPS_SENSITIVE_CREDENTIAL_FIELDS: &[&str] = &[
+    "api_key",
+    "password",
+    "refresh_token",
+    "session_token",
+    "session_cookie",
+    "token_cookie",
+    "auth_cookie",
+    "cookie_string",
+    "cookie",
+];
+const REQUEST_RECORD_LEVEL_KEY: &str = "request_record_level";
+const LEGACY_REQUEST_LOG_LEVEL_KEY: &str = "request_log_level";
+const SENSITIVE_SYSTEM_CONFIG_KEYS: &[&str] = &["smtp_password"];
+const ADMIN_SYSTEM_USERS_EXPORT_VERSION: &str = "1.3";
+
+pub(crate) fn decrypt_admin_system_export_secret(
+    state: &AppState,
+    ciphertext: &str,
+) -> Option<String> {
+    decrypt_catalog_secret_with_fallbacks(state.encryption_key(), ciphertext)
+}
+
+pub(crate) fn normalize_admin_system_export_api_formats(
+    raw_formats: Option<&serde_json::Value>,
+) -> Vec<String> {
+    let Some(raw_formats) = raw_formats.and_then(serde_json::Value::as_array) else {
+        return Vec::new();
+    };
+    let mut normalized = Vec::new();
+    let mut seen = BTreeSet::new();
+    for raw in raw_formats {
+        let Some(value) = raw
+            .as_str()
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+        else {
+            continue;
+        };
+        let Some((signature, _, _)) = admin_endpoint_signature_parts(value) else {
+            continue;
+        };
+        if seen.insert(signature) {
+            normalized.push(signature.to_string());
+        }
+    }
+    normalized
+}
+
+pub(crate) fn resolve_admin_system_export_key_api_formats(
+    raw_formats: Option<&serde_json::Value>,
+    provider_endpoint_formats: &[String],
+) -> Vec<String> {
+    let normalized = normalize_admin_system_export_api_formats(raw_formats);
+    if !normalized.is_empty() {
+        return normalized;
+    }
+    if raw_formats.is_none() {
+        return provider_endpoint_formats.to_vec();
+    }
+    Vec::new()
+}
+
+pub(crate) fn collect_admin_system_export_provider_endpoint_formats(
+    endpoints: &[StoredProviderCatalogEndpoint],
+) -> Vec<String> {
+    endpoints
+        .iter()
+        .filter_map(|endpoint| admin_endpoint_signature_parts(&endpoint.api_format))
+        .map(|(signature, _, _)| signature.to_string())
+        .collect::<BTreeSet<_>>()
+        .into_iter()
+        .collect()
+}
+
+pub(crate) fn decrypt_admin_system_export_provider_config(
+    state: &AppState,
+    config: Option<&serde_json::Value>,
+) -> Option<serde_json::Value> {
+    let mut decrypted = config.cloned()?;
+    let Some(credentials) = decrypted
+        .get_mut("provider_ops")
+        .and_then(serde_json::Value::as_object_mut)
+        .and_then(|provider_ops| provider_ops.get_mut("connector"))
+        .and_then(serde_json::Value::as_object_mut)
+        .and_then(|connector| connector.get_mut("credentials"))
+        .and_then(serde_json::Value::as_object_mut)
+    else {
+        return Some(decrypted);
+    };
+
+    for field in PROVIDER_OPS_SENSITIVE_CREDENTIAL_FIELDS {
+        let Some(serde_json::Value::String(ciphertext)) = credentials.get(*field).cloned() else {
+            continue;
+        };
+        if let Some(plaintext) = decrypt_admin_system_export_secret(state, &ciphertext) {
+            credentials.insert((*field).to_string(), serde_json::Value::String(plaintext));
+        }
+    }
+
+    Some(decrypted)
+}
+
+pub(crate) async fn build_admin_system_config_export_payload(
+    state: &AppState,
+) -> Result<serde_json::Value, GatewayError> {
+    let global_models = state
+        .list_admin_global_models(&AdminGlobalModelListQuery {
+            offset: 0,
+            limit: ADMIN_SYSTEM_EXPORT_PAGE_LIMIT,
+            is_active: None,
+            search: None,
+        })
+        .await?
+        .items;
+    let global_model_name_by_id = global_models
+        .iter()
+        .map(|model| (model.id.clone(), model.name.clone()))
+        .collect::<BTreeMap<_, _>>();
+    let global_models_data = global_models
+        .iter()
+        .map(|model| {
+            json!({
+                "name": model.name,
+                "display_name": model.display_name,
+                "default_price_per_request": model.default_price_per_request,
+                "default_tiered_pricing": model.default_tiered_pricing,
+                "supported_capabilities": model.supported_capabilities,
+                "config": model.config,
+                "is_active": model.is_active,
+            })
+        })
+        .collect::<Vec<_>>();
+
+    let providers = state.list_provider_catalog_providers(false).await?;
+    let provider_ids = providers
+        .iter()
+        .map(|provider| provider.id.clone())
+        .collect::<Vec<_>>();
+    let endpoints = state
+        .list_provider_catalog_endpoints_by_provider_ids(&provider_ids)
+        .await?;
+    let keys = state
+        .list_provider_catalog_keys_by_provider_ids(&provider_ids)
+        .await?;
+
+    let mut endpoints_by_provider = BTreeMap::<String, Vec<_>>::new();
+    for endpoint in endpoints {
+        endpoints_by_provider
+            .entry(endpoint.provider_id.clone())
+            .or_default()
+            .push(endpoint);
+    }
+    let mut keys_by_provider = BTreeMap::<String, Vec<_>>::new();
+    for key in keys {
+        keys_by_provider
+            .entry(key.provider_id.clone())
+            .or_default()
+            .push(key);
+    }
+
+    let mut provider_models_by_provider = BTreeMap::<String, Vec<_>>::new();
+    for provider in &providers {
+        let models = state
+            .list_admin_provider_models(&AdminProviderModelListQuery {
+                provider_id: provider.id.clone(),
+                is_active: None,
+                offset: 0,
+                limit: ADMIN_SYSTEM_EXPORT_PAGE_LIMIT,
+            })
+            .await?;
+        provider_models_by_provider.insert(provider.id.clone(), models);
+    }
+
+    let providers_data = providers
+        .iter()
+        .map(|provider| {
+            let endpoints = endpoints_by_provider.remove(&provider.id).unwrap_or_default();
+            let provider_endpoint_formats =
+                collect_admin_system_export_provider_endpoint_formats(&endpoints);
+            let endpoints_data = endpoints
+                .iter()
+                .map(|endpoint| {
+                    json!({
+                        "api_format": endpoint.api_format,
+                        "base_url": endpoint.base_url,
+                        "header_rules": endpoint.header_rules,
+                        "body_rules": endpoint.body_rules,
+                        "max_retries": endpoint.max_retries,
+                        "is_active": endpoint.is_active,
+                        "custom_path": endpoint.custom_path,
+                        "config": endpoint.config,
+                        "format_acceptance_config": endpoint.format_acceptance_config,
+                        "proxy": endpoint.proxy,
+                    })
+                })
+                .collect::<Vec<_>>();
+
+            let mut keys = keys_by_provider.remove(&provider.id).unwrap_or_default();
+            keys.sort_by(|left, right| {
+                left.internal_priority
+                    .cmp(&right.internal_priority)
+                    .then(
+                        left.created_at_unix_secs
+                            .unwrap_or(0)
+                            .cmp(&right.created_at_unix_secs.unwrap_or(0)),
+                    )
+                    .then(left.id.cmp(&right.id))
+            });
+            let keys_data = keys
+                .iter()
+                .map(|key| {
+                    let api_formats = resolve_admin_system_export_key_api_formats(
+                        key.api_formats.as_ref(),
+                        &provider_endpoint_formats,
+                    );
+                    let mut payload = json!({
+                        "api_formats": api_formats,
+                        "supported_endpoints": api_formats,
+                        "auth_type": key.auth_type,
+                        "name": key.name,
+                        "note": key.note,
+                        "rate_multipliers": key.rate_multipliers,
+                        "internal_priority": key.internal_priority,
+                        "global_priority_by_format": key.global_priority_by_format,
+                        "rpm_limit": key.rpm_limit,
+                        "allowed_models": key.allowed_models,
+                        "capabilities": key.capabilities,
+                        "cache_ttl_minutes": key.cache_ttl_minutes,
+                        "max_probe_interval_minutes": key.max_probe_interval_minutes,
+                        "is_active": key.is_active,
+                        "proxy": key.proxy,
+                        "fingerprint": key.fingerprint,
+                        "auto_fetch_models": key.auto_fetch_models,
+                        "locked_models": key.locked_models,
+                        "model_include_patterns": key.model_include_patterns,
+                        "model_exclude_patterns": key.model_exclude_patterns,
+                        "api_key": decrypt_admin_system_export_secret(state, &key.encrypted_api_key)
+                            .unwrap_or_default(),
+                    });
+                    if let Some(ciphertext) = key.encrypted_auth_config.as_deref() {
+                        if let Some(plaintext) =
+                            decrypt_admin_system_export_secret(state, ciphertext)
+                        {
+                            payload["auth_config"] = json!(plaintext);
+                        }
+                    }
+                    payload
+                })
+                .collect::<Vec<_>>();
+
+            let models_data = provider_models_by_provider
+                .remove(&provider.id)
+                .unwrap_or_default()
+                .into_iter()
+                .map(|model| {
+                    json!({
+                        "provider_model_name": model.provider_model_name,
+                        "provider_model_mappings": model.provider_model_mappings,
+                        "price_per_request": model.price_per_request,
+                        "tiered_pricing": model.tiered_pricing,
+                        "supports_vision": model.supports_vision,
+                        "supports_function_calling": model.supports_function_calling,
+                        "supports_streaming": model.supports_streaming,
+                        "supports_extended_thinking": model.supports_extended_thinking,
+                        "supports_image_generation": model.supports_image_generation,
+                        "is_active": model.is_active,
+                        "config": model.config,
+                        "global_model_name": global_model_name_by_id.get(&model.global_model_id),
+                    })
+                })
+                .collect::<Vec<_>>();
+
+            json!({
+                "name": provider.name,
+                "description": provider.description,
+                "website": provider.website,
+                "provider_type": provider.provider_type,
+                "billing_type": provider.billing_type,
+                "monthly_quota_usd": provider.monthly_quota_usd,
+                "quota_reset_day": provider.quota_reset_day,
+                "provider_priority": provider.provider_priority,
+                "keep_priority_on_conversion": provider.keep_priority_on_conversion,
+                "enable_format_conversion": provider.enable_format_conversion,
+                "is_active": provider.is_active,
+                "concurrent_limit": provider.concurrent_limit,
+                "max_retries": provider.max_retries,
+                "proxy": provider.proxy,
+                "request_timeout": provider.request_timeout_secs,
+                "stream_first_byte_timeout": provider.stream_first_byte_timeout_secs,
+                "config": decrypt_admin_system_export_provider_config(state, provider.config.as_ref()),
+                "endpoints": endpoints_data,
+                "api_keys": keys_data,
+                "models": models_data,
+            })
+        })
+        .collect::<Vec<_>>();
+
+    let ldap_config = state.get_ldap_module_config().await?;
+    let ldap_data = ldap_config.map(|config| {
+        let bind_password = config
+            .bind_password_encrypted
+            .as_deref()
+            .and_then(|ciphertext| decrypt_admin_system_export_secret(state, ciphertext))
+            .unwrap_or_default();
+        json!({
+            "server_url": config.server_url,
+            "bind_dn": config.bind_dn,
+            "bind_password": bind_password,
+            "base_dn": config.base_dn,
+            "user_search_filter": config.user_search_filter,
+            "username_attr": config.username_attr,
+            "email_attr": config.email_attr,
+            "display_name_attr": config.display_name_attr,
+            "is_enabled": config.is_enabled,
+            "is_exclusive": config.is_exclusive,
+            "use_starttls": config.use_starttls,
+            "connect_timeout": config.connect_timeout,
+        })
+    });
+
+    let system_configs = state.list_system_config_entries().await?;
+    let system_configs_data = system_configs
+        .iter()
+        .map(|entry| {
+            let value = if is_sensitive_admin_system_config_key(&entry.key) {
+                entry
+                    .value
+                    .as_str()
+                    .and_then(|ciphertext| decrypt_admin_system_export_secret(state, ciphertext))
+                    .map(serde_json::Value::String)
+                    .unwrap_or_else(|| entry.value.clone())
+            } else {
+                entry.value.clone()
+            };
+            json!({
+                "key": entry.key,
+                "value": value,
+                "description": entry.description,
+            })
+        })
+        .collect::<Vec<_>>();
+
+    let oauth_providers = state.list_oauth_provider_configs().await?;
+    let oauth_data = oauth_providers
+        .iter()
+        .map(|provider| {
+            let client_secret = provider
+                .client_secret_encrypted
+                .as_deref()
+                .and_then(|ciphertext| decrypt_admin_system_export_secret(state, ciphertext))
+                .unwrap_or_default();
+            json!({
+                "provider_type": provider.provider_type,
+                "display_name": provider.display_name,
+                "client_id": provider.client_id,
+                "client_secret": client_secret,
+                "authorization_url_override": provider.authorization_url_override,
+                "token_url_override": provider.token_url_override,
+                "userinfo_url_override": provider.userinfo_url_override,
+                "scopes": provider.scopes,
+                "redirect_uri": provider.redirect_uri,
+                "frontend_callback_url": provider.frontend_callback_url,
+                "attribute_mapping": provider.attribute_mapping,
+                "extra_config": provider.extra_config,
+                "is_enabled": provider.is_enabled,
+            })
+        })
+        .collect::<Vec<_>>();
+
+    let proxy_nodes = state.list_proxy_nodes().await?;
+    let proxy_nodes_data = proxy_nodes
+        .iter()
+        .map(|node| {
+            json!({
+                "id": node.id,
+                "name": node.name,
+                "ip": node.ip,
+                "port": node.port,
+                "region": node.region,
+                "is_manual": node.is_manual,
+                "proxy_url": node.proxy_url,
+                "proxy_username": node.proxy_username,
+                "proxy_password": node.proxy_password,
+                "tunnel_mode": node.tunnel_mode,
+                "heartbeat_interval": node.heartbeat_interval,
+                "remote_config": node.remote_config,
+                "config_version": node.config_version,
+            })
+        })
+        .collect::<Vec<_>>();
+
+    Ok(json!({
+        "version": ADMIN_SYSTEM_CONFIG_EXPORT_VERSION,
+        "exported_at": Utc::now().to_rfc3339(),
+        "global_models": global_models_data,
+        "providers": providers_data,
+        "proxy_nodes": proxy_nodes_data,
+        "ldap_config": ldap_data,
+        "oauth_providers": oauth_data,
+        "system_configs": system_configs_data,
+    }))
+}
+
+pub(crate) fn serialize_admin_system_users_export_wallet(
+    wallet: Option<&aether_data::repository::wallet::StoredWalletSnapshot>,
+) -> Option<serde_json::Value> {
+    let wallet = wallet?;
+    let recharge_balance = wallet.balance;
+    let gift_balance = wallet.gift_balance;
+    let spendable_balance = recharge_balance + gift_balance;
+    let unlimited = wallet.limit_mode.eq_ignore_ascii_case("unlimited");
+
+    Some(json!({
+        "id": wallet.id.clone(),
+        "balance": spendable_balance,
+        "recharge_balance": recharge_balance,
+        "gift_balance": gift_balance,
+        "refundable_balance": recharge_balance,
+        "currency": wallet.currency.clone(),
+        "status": wallet.status.clone(),
+        "limit_mode": wallet.limit_mode.clone(),
+        "unlimited": unlimited,
+        "total_recharged": wallet.total_recharged,
+        "total_consumed": wallet.total_consumed,
+        "total_refunded": wallet.total_refunded,
+        "total_adjusted": wallet.total_adjusted,
+        "updated_at": unix_secs_to_rfc3339(wallet.updated_at_unix_secs),
+    }))
+}
+
+fn build_admin_system_users_export_api_key_payload(
+    state: &AppState,
+    key: &aether_data::repository::auth::StoredAuthApiKeyExportRecord,
+    wallet: Option<&aether_data::repository::wallet::StoredWalletSnapshot>,
+    include_is_standalone: bool,
+) -> serde_json::Value {
+    let mut payload = serde_json::Map::from_iter([
+        ("key_hash".to_string(), json!(key.key_hash.clone())),
+        ("name".to_string(), json!(key.name.clone())),
+        (
+            "allowed_providers".to_string(),
+            json!(key.allowed_providers.clone()),
+        ),
+        (
+            "allowed_api_formats".to_string(),
+            json!(key.allowed_api_formats.clone()),
+        ),
+        (
+            "allowed_models".to_string(),
+            json!(key.allowed_models.clone()),
+        ),
+        ("rate_limit".to_string(), json!(key.rate_limit)),
+        ("concurrent_limit".to_string(), json!(key.concurrent_limit)),
+        (
+            "force_capabilities".to_string(),
+            json!(key.force_capabilities.clone()),
+        ),
+        ("is_active".to_string(), json!(key.is_active)),
+        (
+            "expires_at".to_string(),
+            json!(key.expires_at_unix_secs.and_then(unix_secs_to_rfc3339)),
+        ),
+        (
+            "auto_delete_on_expiry".to_string(),
+            json!(key.auto_delete_on_expiry),
+        ),
+        ("total_requests".to_string(), json!(key.total_requests)),
+        ("total_cost_usd".to_string(), json!(key.total_cost_usd)),
+        (
+            "wallet".to_string(),
+            serialize_admin_system_users_export_wallet(wallet).unwrap_or(serde_json::Value::Null),
+        ),
+    ]);
+
+    if let Some(ciphertext) = key.key_encrypted.as_deref() {
+        if let Some(plaintext) = decrypt_admin_system_export_secret(state, ciphertext) {
+            payload.insert("key".to_string(), serde_json::Value::String(plaintext));
+        } else {
+            payload.insert(
+                "key_encrypted".to_string(),
+                serde_json::Value::String(ciphertext.to_string()),
+            );
+        }
+    }
+
+    if include_is_standalone {
+        payload.insert("is_standalone".to_string(), json!(key.is_standalone));
+    }
+
+    serde_json::Value::Object(payload)
+}
+
+pub(crate) async fn build_admin_system_users_export_payload(
+    state: &AppState,
+) -> Result<serde_json::Value, GatewayError> {
+    let users = state.list_non_admin_export_users().await?;
+    let user_ids = users.iter().map(|user| user.id.clone()).collect::<Vec<_>>();
+    let user_wallets = state.list_wallet_snapshots_by_user_ids(&user_ids).await?;
+    let user_api_keys = state
+        .list_auth_api_key_export_records_by_user_ids(&user_ids)
+        .await?;
+    let standalone_api_keys = state.list_auth_api_key_export_standalone_records().await?;
+    let standalone_api_key_ids = standalone_api_keys
+        .iter()
+        .map(|key| key.api_key_id.clone())
+        .collect::<Vec<_>>();
+    let standalone_wallets = state
+        .list_wallet_snapshots_by_api_key_ids(&standalone_api_key_ids)
+        .await?;
+
+    let wallets_by_user_id = user_wallets
+        .into_iter()
+        .filter_map(|wallet| wallet.user_id.clone().map(|user_id| (user_id, wallet)))
+        .collect::<BTreeMap<_, _>>();
+    let wallets_by_api_key_id = standalone_wallets
+        .into_iter()
+        .filter_map(|wallet| {
+            wallet
+                .api_key_id
+                .clone()
+                .map(|api_key_id| (api_key_id, wallet))
+        })
+        .collect::<BTreeMap<_, _>>();
+
+    let mut api_keys_by_user_id =
+        BTreeMap::<String, Vec<aether_data::repository::auth::StoredAuthApiKeyExportRecord>>::new();
+    for key in user_api_keys.into_iter().filter(|key| !key.is_standalone) {
+        api_keys_by_user_id
+            .entry(key.user_id.clone())
+            .or_default()
+            .push(key);
+    }
+
+    let users_data = users
+        .iter()
+        .map(|user| {
+            let wallet = wallets_by_user_id.get(&user.id);
+            let wallet_payload = serialize_admin_system_users_export_wallet(wallet);
+            let api_keys = api_keys_by_user_id.remove(&user.id).unwrap_or_default();
+            let api_keys_payload = api_keys
+                .iter()
+                .map(|key| build_admin_system_users_export_api_key_payload(state, key, None, true))
+                .collect::<Vec<_>>();
+
+            json!({
+                "email": user.email.clone(),
+                "email_verified": user.email_verified,
+                "username": user.username.clone(),
+                "password_hash": user.password_hash.clone(),
+                "role": user.role.clone(),
+                "allowed_providers": user.allowed_providers.clone(),
+                "allowed_api_formats": user.allowed_api_formats.clone(),
+                "allowed_models": user.allowed_models.clone(),
+                "rate_limit": user.rate_limit,
+                "model_capability_settings": user.model_capability_settings.clone(),
+                "unlimited": wallet
+                    .map(|entry| entry.limit_mode.eq_ignore_ascii_case("unlimited"))
+                    .unwrap_or(false),
+                "wallet": wallet_payload,
+                "is_active": user.is_active,
+                "api_keys": api_keys_payload,
+            })
+        })
+        .collect::<Vec<_>>();
+
+    let standalone_keys_data = standalone_api_keys
+        .iter()
+        .map(|key| {
+            build_admin_system_users_export_api_key_payload(
+                state,
+                key,
+                wallets_by_api_key_id.get(&key.api_key_id),
+                false,
+            )
+        })
+        .collect::<Vec<_>>();
+
+    Ok(json!({
+        "version": ADMIN_SYSTEM_USERS_EXPORT_VERSION,
+        "exported_at": Utc::now().to_rfc3339(),
+        "users": users_data,
+        "standalone_keys": standalone_keys_data,
+    }))
+}
+
+fn normalize_admin_system_config_key(requested_key: &str) -> String {
+    let trimmed = requested_key.trim();
+    if trimmed.eq_ignore_ascii_case(LEGACY_REQUEST_LOG_LEVEL_KEY) {
+        REQUEST_RECORD_LEVEL_KEY.to_string()
+    } else {
+        trimmed.to_string()
+    }
+}
+
+fn admin_system_config_delete_keys(requested_key: &str) -> Vec<String> {
+    let normalized = normalize_admin_system_config_key(requested_key);
+    if normalized == REQUEST_RECORD_LEVEL_KEY {
+        vec![
+            REQUEST_RECORD_LEVEL_KEY.to_string(),
+            LEGACY_REQUEST_LOG_LEVEL_KEY.to_string(),
+        ]
+    } else {
+        vec![normalized]
+    }
+}
+
+fn is_sensitive_admin_system_config_key(key: &str) -> bool {
+    SENSITIVE_SYSTEM_CONFIG_KEYS
+        .iter()
+        .any(|candidate| candidate.eq_ignore_ascii_case(key))
+}
+
+fn system_config_is_set(value: &serde_json::Value) -> bool {
+    match value {
+        serde_json::Value::Null => false,
+        serde_json::Value::Bool(value) => *value,
+        serde_json::Value::Number(value) => value
+            .as_i64()
+            .map(|value| value != 0)
+            .or_else(|| value.as_u64().map(|value| value != 0))
+            .or_else(|| value.as_f64().map(|value| value != 0.0))
+            .unwrap_or(false),
+        serde_json::Value::String(value) => !value.trim().is_empty(),
+        serde_json::Value::Array(value) => !value.is_empty(),
+        serde_json::Value::Object(value) => !value.is_empty(),
+    }
+}
+
+fn admin_system_config_default_value(key: &str) -> Option<serde_json::Value> {
+    match key {
+        "site_name" => Some(json!("Aether")),
+        "site_subtitle" => Some(json!("AI Gateway")),
+        "default_user_initial_gift_usd" => Some(json!(10.0)),
+        "password_policy_level" => Some(json!("weak")),
+        REQUEST_RECORD_LEVEL_KEY => Some(json!("basic")),
+        "max_request_body_size" => Some(json!(5_242_880)),
+        "max_response_body_size" => Some(json!(5_242_880)),
+        "sensitive_headers" => Some(json!([
+            "authorization",
+            "x-api-key",
+            "api-key",
+            "cookie",
+            "set-cookie"
+        ])),
+        "detail_log_retention_days" => Some(json!(7)),
+        "compressed_log_retention_days" => Some(json!(30)),
+        "header_retention_days" => Some(json!(90)),
+        "log_retention_days" => Some(json!(365)),
+        "enable_auto_cleanup" => Some(json!(true)),
+        "cleanup_batch_size" => Some(json!(1000)),
+        "request_candidates_retention_days" => Some(json!(30)),
+        "request_candidates_cleanup_batch_size" => Some(json!(5000)),
+        "enable_provider_checkin" => Some(json!(true)),
+        "provider_checkin_time" => Some(json!("01:05")),
+        "provider_priority_mode" => Some(json!("provider")),
+        "scheduling_mode" => Some(json!("cache_affinity")),
+        "auto_delete_expired_keys" => Some(json!(false)),
+        "email_suffix_mode" => Some(json!("none")),
+        "email_suffix_list" => Some(json!([])),
+        "enable_format_conversion" => Some(json!(true)),
+        "keep_priority_on_conversion" => Some(json!(false)),
+        "audit_log_retention_days" => Some(json!(30)),
+        "enable_db_maintenance" => Some(json!(true)),
+        "system_proxy_node_id" => Some(serde_json::Value::Null),
+        "smtp_host" => Some(serde_json::Value::Null),
+        "smtp_port" => Some(json!(587)),
+        "smtp_user" => Some(serde_json::Value::Null),
+        "smtp_password" => Some(serde_json::Value::Null),
+        "smtp_use_tls" => Some(json!(true)),
+        "smtp_use_ssl" => Some(json!(false)),
+        "smtp_from_email" => Some(serde_json::Value::Null),
+        "smtp_from_name" => Some(json!("Aether")),
+        "enable_oauth_token_refresh" => Some(json!(true)),
+        _ => None,
+    }
+}
+
+fn build_admin_system_config_list_item(
+    key: &str,
+    value: &serde_json::Value,
+    description: Option<&str>,
+    updated_at_unix_secs: Option<u64>,
+) -> serde_json::Value {
+    let masked_value = if is_sensitive_admin_system_config_key(key) {
+        serde_json::Value::Null
+    } else {
+        value.clone()
+    };
+    let is_set = is_sensitive_admin_system_config_key(key).then(|| system_config_is_set(value));
+    let mut payload = json!({
+        "key": key,
+        "description": description,
+        "updated_at": updated_at_unix_secs.and_then(unix_secs_to_rfc3339),
+        "value": masked_value,
+    });
+    if let Some(is_set) = is_set {
+        payload["is_set"] = json!(is_set);
+    }
+    payload
+}
+
+pub(crate) fn build_admin_system_configs_payload(
+    entries: &[aether_data::repository::system::StoredSystemConfigEntry],
+) -> serde_json::Value {
+    let has_request_record_level = entries
+        .iter()
+        .any(|entry| entry.key == REQUEST_RECORD_LEVEL_KEY);
+    json!(entries
+        .iter()
+        .filter_map(|entry| {
+            if entry.key == LEGACY_REQUEST_LOG_LEVEL_KEY && has_request_record_level {
+                return None;
+            }
+            let key = if entry.key == LEGACY_REQUEST_LOG_LEVEL_KEY {
+                REQUEST_RECORD_LEVEL_KEY
+            } else {
+                entry.key.as_str()
+            };
+            Some(build_admin_system_config_list_item(
+                key,
+                &entry.value,
+                entry.description.as_deref(),
+                entry.updated_at_unix_secs,
+            ))
+        })
+        .collect::<Vec<_>>())
+}
+
+pub(crate) async fn build_admin_system_config_detail_payload(
+    state: &AppState,
+    requested_key: &str,
+) -> Result<Result<serde_json::Value, (http::StatusCode, serde_json::Value)>, GatewayError> {
+    let requested_key = requested_key.trim();
+    let normalized_key = normalize_admin_system_config_key(requested_key);
+    let value = state
+        .read_system_config_json_value(&normalized_key)
+        .await?
+        .or_else(|| admin_system_config_default_value(&normalized_key));
+    let Some(value) = value else {
+        return Ok(Err((
+            http::StatusCode::NOT_FOUND,
+            json!({ "detail": format!("配置项 '{requested_key}' 不存在") }),
+        )));
+    };
+    if is_sensitive_admin_system_config_key(&normalized_key) {
+        return Ok(Ok(json!({
+            "key": requested_key,
+            "value": serde_json::Value::Null,
+            "is_set": system_config_is_set(&value),
+        })));
+    }
+    Ok(Ok(json!({
+        "key": requested_key,
+        "value": value,
+    })))
+}
+
+pub(crate) async fn apply_admin_system_config_update(
+    state: &AppState,
+    requested_key: &str,
+    request_body: &Bytes,
+) -> Result<Result<serde_json::Value, (http::StatusCode, serde_json::Value)>, GatewayError> {
+    let payload = match serde_json::from_slice::<serde_json::Value>(request_body) {
+        Ok(serde_json::Value::Object(payload)) => payload,
+        _ => {
+            return Ok(Err((
+                http::StatusCode::BAD_REQUEST,
+                json!({ "detail": "请求数据验证失败" }),
+            )));
+        }
+    };
+    let normalized_key = normalize_admin_system_config_key(requested_key);
+    let mut value = payload
+        .get("value")
+        .cloned()
+        .unwrap_or(serde_json::Value::Null);
+    let description = match payload.get("description") {
+        Some(serde_json::Value::String(value)) => Some(value.trim().to_string()),
+        Some(serde_json::Value::Null) | None => None,
+        Some(_) => {
+            return Ok(Err((
+                http::StatusCode::BAD_REQUEST,
+                json!({ "detail": "请求数据验证失败" }),
+            )));
+        }
+    };
+
+    if normalized_key == "password_policy_level" {
+        match value.as_str().map(str::trim) {
+            Some("weak" | "medium" | "strong") => {
+                value = json!(value.as_str().unwrap().trim());
+            }
+            Some(_) => {
+                return Ok(Err((
+                    http::StatusCode::BAD_REQUEST,
+                    json!({ "detail": "请求数据验证失败" }),
+                )));
+            }
+            None if value.is_null() => {
+                value = json!("weak");
+            }
+            None => {
+                return Ok(Err((
+                    http::StatusCode::BAD_REQUEST,
+                    json!({ "detail": "请求数据验证失败" }),
+                )));
+            }
+        }
+    }
+
+    if is_sensitive_admin_system_config_key(&normalized_key)
+        && value.as_str().is_some_and(|raw| !raw.is_empty())
+    {
+        let Some(encryption_key) = state
+            .encryption_key()
+            .filter(|value| !value.trim().is_empty())
+        else {
+            return Ok(Err((
+                http::StatusCode::SERVICE_UNAVAILABLE,
+                json!({ "detail": "系统配置写入需要可用的加密密钥" }),
+            )));
+        };
+        let plaintext = value.as_str().unwrap();
+        value = json!(encrypt_python_fernet_plaintext(encryption_key, plaintext)
+            .map_err(|err| GatewayError::Internal(err.to_string()))?);
+    }
+
+    let updated = state
+        .upsert_system_config_entry(&normalized_key, &value, description.as_deref())
+        .await?;
+    let display_value = if is_sensitive_admin_system_config_key(&normalized_key) {
+        json!("********")
+    } else {
+        updated.value.clone()
+    };
+    Ok(Ok(json!({
+        "key": updated.key,
+        "value": display_value,
+        "description": updated.description,
+        "updated_at": updated.updated_at_unix_secs.and_then(unix_secs_to_rfc3339),
+    })))
+}
+
+pub(crate) async fn delete_admin_system_config(
+    state: &AppState,
+    requested_key: &str,
+) -> Result<Result<serde_json::Value, (http::StatusCode, serde_json::Value)>, GatewayError> {
+    let delete_keys = admin_system_config_delete_keys(requested_key);
+    let mut deleted = false;
+    for key in &delete_keys {
+        deleted |= state.delete_system_config_value(key).await?;
+    }
+    if !deleted {
+        return Ok(Err((
+            http::StatusCode::NOT_FOUND,
+            json!({ "detail": format!("配置项 '{requested_key}' 不存在") }),
+        )));
+    }
+    Ok(Ok(json!({
+        "message": format!("配置项 '{}' 已删除", requested_key.trim()),
+    })))
+}

apps/aether-gateway/src/handlers/admin/system/shared/mod.rs

@@ -0,0 +1,9 @@
+mod configs;
+mod modules;
+mod paths;
+mod settings;
+
+pub(crate) use self::configs::*;
+pub(crate) use self::modules::*;
+pub(crate) use self::paths::*;
+pub(crate) use self::settings::*;

apps/aether-gateway/src/handlers/admin/system/shared/modules.rs

@@ -0,0 +1,387 @@
+use crate::handlers::public::{module_available_from_env, system_config_bool};
+use crate::{AppState, GatewayError};
+use serde_json::json;
+
+pub(crate) struct AdminModuleDefinition {
+    pub(crate) name: &'static str,
+    pub(crate) display_name: &'static str,
+    pub(crate) description: &'static str,
+    pub(crate) category: &'static str,
+    pub(crate) env_key: &'static str,
+    pub(crate) default_available: bool,
+    pub(crate) admin_route: Option<&'static str>,
+    pub(crate) admin_menu_icon: Option<&'static str>,
+    pub(crate) admin_menu_group: Option<&'static str>,
+    pub(crate) admin_menu_order: i32,
+}
+
+pub(crate) const ADMIN_MODULE_DEFINITIONS: &[AdminModuleDefinition] = &[
+    AdminModuleDefinition {
+        name: "oauth",
+        display_name: "OAuth 登录",
+        description: "支持通过第三方 OAuth Provider 登录/绑定账号",
+        category: "auth",
+        env_key: "OAUTH_AVAILABLE",
+        default_available: true,
+        admin_route: Some("/admin/oauth"),
+        admin_menu_icon: Some("Key"),
+        admin_menu_group: None,
+        admin_menu_order: 55,
+    },
+    AdminModuleDefinition {
+        name: "ldap",
+        display_name: "LDAP 认证",
+        description: "支持通过 LDAP/Active Directory 进行用户认证",
+        category: "auth",
+        env_key: "LDAP_AVAILABLE",
+        default_available: true,
+        admin_route: Some("/admin/ldap"),
+        admin_menu_icon: Some("Users"),
+        admin_menu_group: Some("system"),
+        admin_menu_order: 50,
+    },
+    AdminModuleDefinition {
+        name: "management_tokens",
+        display_name: "访问令牌",
+        description: "管理 API 访问令牌，支持细粒度权限控制和 IP 白名单",
+        category: "security",
+        env_key: "MANAGEMENT_TOKENS_AVAILABLE",
+        default_available: true,
+        admin_route: Some("/admin/management-tokens"),
+        admin_menu_icon: None,
+        admin_menu_group: None,
+        admin_menu_order: 0,
+    },
+    AdminModuleDefinition {
+        name: "notification_email",
+        display_name: "异常通知",
+        description: "为 5xx 异常发送邮件通知，可在模块管理中启用或禁用",
+        category: "integration",
+        env_key: "NOTIFICATION_EMAIL_AVAILABLE",
+        default_available: true,
+        admin_route: None,
+        admin_menu_icon: Some("Mail"),
+        admin_menu_group: Some("system"),
+        admin_menu_order: 58,
+    },
+    AdminModuleDefinition {
+        name: "gemini_files",
+        display_name: "文件缓存",
+        description: "管理 Gemini Files API 上传的文件，支持文件上传、查看和删除",
+        category: "integration",
+        env_key: "GEMINI_FILES_AVAILABLE",
+        default_available: true,
+        admin_route: Some("/admin/gemini-files"),
+        admin_menu_icon: Some("FileUp"),
+        admin_menu_group: Some("system"),
+        admin_menu_order: 60,
+    },
+    AdminModuleDefinition {
+        name: "proxy_nodes",
+        display_name: "代理节点",
+        description: "添加Http/Socket代理节点, 或使用Aether-Proxy自动连接代理节点.",
+        category: "integration",
+        env_key: "PROXY_NODES_AVAILABLE",
+        default_available: true,
+        admin_route: Some("/admin/proxy-nodes"),
+        admin_menu_icon: Some("Server"),
+        admin_menu_group: Some("system"),
+        admin_menu_order: 60,
+    },
+];
+
+#[derive(Debug, Clone, serde::Deserialize)]
+pub(crate) struct AdminSetModuleEnabledRequest {
+    pub(crate) enabled: bool,
+}
+
+pub(crate) struct AdminModuleRuntimeState {
+    oauth_providers: Vec<aether_data::repository::auth_modules::StoredOAuthProviderModuleConfig>,
+    ldap_config: Option<aether_data::repository::auth_modules::StoredLdapModuleConfig>,
+    gemini_files_has_capable_key: bool,
+    smtp_configured: bool,
+}
+
+pub(crate) fn admin_module_by_name(name: &str) -> Option<&'static AdminModuleDefinition> {
+    ADMIN_MODULE_DEFINITIONS
+        .iter()
+        .find(|module| module.name == name)
+}
+
+pub(crate) fn admin_module_name_from_status_path(request_path: &str) -> Option<String> {
+    request_path
+        .strip_prefix("/api/admin/modules/status/")
+        .map(str::trim)
+        .filter(|value| !value.is_empty() && !value.contains('/'))
+        .map(ToOwned::to_owned)
+}
+
+pub(crate) fn admin_module_name_from_enabled_path(request_path: &str) -> Option<String> {
+    request_path
+        .strip_prefix("/api/admin/modules/status/")
+        .and_then(|value| value.strip_suffix("/enabled"))
+        .map(str::trim)
+        .filter(|value| !value.is_empty() && !value.contains('/'))
+        .map(ToOwned::to_owned)
+}
+
+pub(crate) fn oauth_module_config_is_valid(
+    providers: &[aether_data::repository::auth_modules::StoredOAuthProviderModuleConfig],
+) -> bool {
+    !providers.is_empty()
+        && providers.iter().all(|provider| {
+            !provider.client_id.trim().is_empty()
+                && provider
+                    .client_secret_encrypted
+                    .as_deref()
+                    .map(str::trim)
+                    .filter(|value| !value.is_empty())
+                    .is_some()
+                && !provider.redirect_uri.trim().is_empty()
+        })
+}
+
+pub(crate) fn ldap_module_config_is_valid(
+    config: Option<&aether_data::repository::auth_modules::StoredLdapModuleConfig>,
+) -> bool {
+    let Some(config) = config else {
+        return false;
+    };
+    !config.server_url.trim().is_empty()
+        && !config.bind_dn.trim().is_empty()
+        && !config.base_dn.trim().is_empty()
+        && config
+            .bind_password_encrypted
+            .as_deref()
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+            .is_some()
+}
+
+pub(crate) async fn build_admin_module_runtime_state(
+    state: &AppState,
+) -> Result<AdminModuleRuntimeState, GatewayError> {
+    let oauth_providers = state.list_enabled_oauth_module_providers().await?;
+    let ldap_config = state.get_ldap_module_config().await?;
+
+    let provider_ids = state
+        .list_provider_catalog_providers(false)
+        .await
+        .ok()
+        .unwrap_or_default()
+        .into_iter()
+        .map(|provider| provider.id)
+        .collect::<Vec<_>>();
+    let gemini_files_has_capable_key = if provider_ids.is_empty() {
+        false
+    } else {
+        state
+            .list_provider_catalog_keys_by_provider_ids(&provider_ids)
+            .await
+            .ok()
+            .unwrap_or_default()
+            .into_iter()
+            .any(|key| {
+                key.is_active
+                    && key
+                        .capabilities
+                        .as_ref()
+                        .and_then(|value| value.get("gemini_files"))
+                        .and_then(serde_json::Value::as_bool)
+                        == Some(true)
+            })
+    };
+
+    let smtp_host = state.read_system_config_json_value("smtp_host").await?;
+    let smtp_from_email = state
+        .read_system_config_json_value("smtp_from_email")
+        .await?;
+    let smtp_configured = smtp_host
+        .as_ref()
+        .and_then(serde_json::Value::as_str)
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .is_some()
+        && smtp_from_email
+            .as_ref()
+            .and_then(serde_json::Value::as_str)
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+            .is_some();
+
+    Ok(AdminModuleRuntimeState {
+        oauth_providers,
+        ldap_config,
+        gemini_files_has_capable_key,
+        smtp_configured,
+    })
+}
+
+pub(crate) fn build_admin_module_validation_result(
+    module: &AdminModuleDefinition,
+    runtime: &AdminModuleRuntimeState,
+) -> (bool, Option<String>) {
+    match module.name {
+        "oauth" => {
+            if runtime.oauth_providers.is_empty() {
+                return (
+                    false,
+                    Some("请先配置并启用至少一个 OAuth Provider".to_string()),
+                );
+            }
+            for provider in &runtime.oauth_providers {
+                if provider.client_id.trim().is_empty() {
+                    return (
+                        false,
+                        Some(format!(
+                            "Provider [{}] 未配置 Client ID",
+                            provider.display_name
+                        )),
+                    );
+                }
+                if provider
+                    .client_secret_encrypted
+                    .as_deref()
+                    .map(str::trim)
+                    .filter(|value| !value.is_empty())
+                    .is_none()
+                {
+                    return (
+                        false,
+                        Some(format!(
+                            "Provider [{}] 未配置 Client Secret",
+                            provider.display_name
+                        )),
+                    );
+                }
+                if provider.redirect_uri.trim().is_empty() {
+                    return (
+                        false,
+                        Some(format!(
+                            "Provider [{}] 未配置回调地址",
+                            provider.display_name
+                        )),
+                    );
+                }
+            }
+            (true, None)
+        }
+        "ldap" => {
+            let Some(config) = runtime.ldap_config.as_ref() else {
+                return (false, Some("请先配置 LDAP 连接信息".to_string()));
+            };
+            if config.server_url.trim().is_empty() {
+                return (false, Some("请配置 LDAP 服务器地址".to_string()));
+            }
+            if config.bind_dn.trim().is_empty() {
+                return (false, Some("请配置绑定 DN".to_string()));
+            }
+            if config.base_dn.trim().is_empty() {
+                return (false, Some("请配置搜索基准 DN".to_string()));
+            }
+            if config
+                .bind_password_encrypted
+                .as_deref()
+                .map(str::trim)
+                .filter(|value| !value.is_empty())
+                .is_none()
+            {
+                return (false, Some("请配置绑定密码".to_string()));
+            }
+            (true, None)
+        }
+        "notification_email" => {
+            if runtime.smtp_configured {
+                (true, None)
+            } else {
+                (false, Some("请先完成邮件配置（SMTP）".to_string()))
+            }
+        }
+        "gemini_files" => {
+            if runtime.gemini_files_has_capable_key {
+                (true, None)
+            } else {
+                (
+                    false,
+                    Some("至少启用一个具有「Gemini 文件 API」能力的 Key".to_string()),
+                )
+            }
+        }
+        "management_tokens" | "proxy_nodes" => (true, None),
+        _ => (true, None),
+    }
+}
+
+pub(crate) fn build_admin_module_health(
+    module: &AdminModuleDefinition,
+    runtime: &AdminModuleRuntimeState,
+) -> &'static str {
+    match module.name {
+        "management_tokens" | "proxy_nodes" => "healthy",
+        "gemini_files" => {
+            if runtime.gemini_files_has_capable_key {
+                "healthy"
+            } else {
+                "degraded"
+            }
+        }
+        _ => "unknown",
+    }
+}
+
+pub(crate) async fn build_admin_module_status_payload(
+    state: &AppState,
+    module: &AdminModuleDefinition,
+    runtime: &AdminModuleRuntimeState,
+) -> Result<serde_json::Value, GatewayError> {
+    let available = module_available_from_env(module.env_key, module.default_available);
+    let enabled = if available {
+        let enabled = state
+            .read_system_config_json_value(&format!("module.{}.enabled", module.name))
+            .await?;
+        system_config_bool(enabled.as_ref(), false)
+    } else {
+        false
+    };
+    let (config_validated, config_error) = if available {
+        build_admin_module_validation_result(module, runtime)
+    } else {
+        (false, None)
+    };
+    let active = available && enabled && config_validated;
+    let health = if available {
+        build_admin_module_health(module, runtime)
+    } else {
+        "unknown"
+    };
+    Ok(json!({
+        "name": module.name,
+        "available": available,
+        "enabled": enabled,
+        "active": active,
+        "config_validated": config_validated,
+        "config_error": if config_validated { serde_json::Value::Null } else { json!(config_error) },
+        "display_name": module.display_name,
+        "description": module.description,
+        "category": module.category,
+        "admin_route": if available { json!(module.admin_route) } else { serde_json::Value::Null },
+        "admin_menu_icon": module.admin_menu_icon,
+        "admin_menu_group": module.admin_menu_group,
+        "admin_menu_order": module.admin_menu_order,
+        "health": health,
+    }))
+}
+
+pub(crate) async fn build_admin_modules_status_payload(
+    state: &AppState,
+) -> Result<serde_json::Value, GatewayError> {
+    let runtime = build_admin_module_runtime_state(state).await?;
+    let mut payload = serde_json::Map::new();
+    for module in ADMIN_MODULE_DEFINITIONS {
+        payload.insert(
+            module.name.to_string(),
+            build_admin_module_status_payload(state, module, &runtime).await?,
+        );
+    }
+    Ok(serde_json::Value::Object(payload))
+}

apps/aether-gateway/src/handlers/admin/system/shared/paths.rs

@@ -0,0 +1,84 @@
+pub(crate) fn is_admin_management_tokens_root(request_path: &str) -> bool {
+    matches!(
+        request_path,
+        "/api/admin/management-tokens" | "/api/admin/management-tokens/"
+    )
+}
+
+pub(crate) fn is_admin_system_configs_root(request_path: &str) -> bool {
+    matches!(
+        request_path,
+        "/api/admin/system/configs" | "/api/admin/system/configs/"
+    )
+}
+
+pub(crate) fn is_admin_system_email_templates_root(request_path: &str) -> bool {
+    matches!(
+        request_path,
+        "/api/admin/system/email/templates" | "/api/admin/system/email/templates/"
+    )
+}
+
+pub(crate) fn admin_system_config_key_from_path(request_path: &str) -> Option<String> {
+    let value = request_path
+        .strip_prefix("/api/admin/system/configs/")?
+        .trim()
+        .trim_matches('/')
+        .to_string();
+    if value.is_empty() || value.contains('/') {
+        None
+    } else {
+        Some(value)
+    }
+}
+
+pub(crate) fn admin_system_email_template_type_from_path(request_path: &str) -> Option<String> {
+    let value = request_path
+        .strip_prefix("/api/admin/system/email/templates/")?
+        .trim()
+        .trim_matches('/')
+        .to_string();
+    if value.is_empty() || value.contains('/') {
+        None
+    } else {
+        Some(value)
+    }
+}
+
+pub(crate) fn admin_system_email_template_preview_type_from_path(
+    request_path: &str,
+) -> Option<String> {
+    request_path
+        .strip_prefix("/api/admin/system/email/templates/")?
+        .strip_suffix("/preview")
+        .map(|value| value.trim().trim_matches('/').to_string())
+        .filter(|value| !value.is_empty() && !value.contains('/'))
+}
+
+pub(crate) fn admin_system_email_template_reset_type_from_path(
+    request_path: &str,
+) -> Option<String> {
+    request_path
+        .strip_prefix("/api/admin/system/email/templates/")?
+        .strip_suffix("/reset")
+        .map(|value| value.trim().trim_matches('/').to_string())
+        .filter(|value| !value.is_empty() && !value.contains('/'))
+}
+
+pub(crate) fn admin_management_token_id_from_path(request_path: &str) -> Option<String> {
+    let raw = request_path.strip_prefix("/api/admin/management-tokens/")?;
+    let normalized = raw.trim().trim_matches('/');
+    if normalized.is_empty() || normalized.contains('/') {
+        None
+    } else {
+        Some(normalized.to_string())
+    }
+}
+
+pub(crate) fn admin_management_token_status_id_from_path(request_path: &str) -> Option<String> {
+    request_path
+        .strip_prefix("/api/admin/management-tokens/")?
+        .strip_suffix("/status")
+        .map(|value| value.trim().trim_matches('/').to_string())
+        .filter(|value| !value.is_empty() && !value.contains('/'))
+}

apps/aether-gateway/src/handlers/admin/system/shared/settings.rs

@@ -0,0 +1,312 @@
+use crate::handlers::public::{system_config_bool, system_config_string};
+use crate::{AppState, GatewayError};
+use axum::body::Bytes;
+use axum::http;
+use serde_json::json;
+use std::fs;
+
+#[derive(Debug, Clone, Copy)]
+struct AdminApiFormatDefinition {
+    value: &'static str,
+    label: &'static str,
+    default_path: &'static str,
+    aliases: &'static [&'static str],
+}
+
+const ADMIN_API_FORMAT_DEFINITIONS: &[AdminApiFormatDefinition] = &[
+    AdminApiFormatDefinition {
+        value: "openai:chat",
+        label: "OpenAI Chat",
+        default_path: "/v1/chat/completions",
+        aliases: &[
+            "openai",
+            "openai_compatible",
+            "deepseek",
+            "grok",
+            "moonshot",
+            "zhipu",
+            "qwen",
+            "baichuan",
+            "minimax",
+        ],
+    },
+    AdminApiFormatDefinition {
+        value: "openai:cli",
+        label: "OpenAI CLI",
+        default_path: "/v1/responses",
+        aliases: &["openai_cli", "responses"],
+    },
+    AdminApiFormatDefinition {
+        value: "openai:compact",
+        label: "OpenAI Compact",
+        default_path: "/v1/responses/compact",
+        aliases: &["openai_compact", "responses_compact"],
+    },
+    AdminApiFormatDefinition {
+        value: "openai:video",
+        label: "OpenAI Video",
+        default_path: "/v1/videos",
+        aliases: &["openai_video", "sora"],
+    },
+    AdminApiFormatDefinition {
+        value: "claude:chat",
+        label: "Claude Chat",
+        default_path: "/v1/messages",
+        aliases: &["claude", "anthropic", "claude_compatible"],
+    },
+    AdminApiFormatDefinition {
+        value: "claude:cli",
+        label: "Claude CLI",
+        default_path: "/v1/messages",
+        aliases: &["claude_cli", "claude-cli"],
+    },
+    AdminApiFormatDefinition {
+        value: "gemini:chat",
+        label: "Gemini Chat",
+        default_path: "/v1beta/models/{model}:{action}",
+        aliases: &["gemini", "google", "vertex"],
+    },
+    AdminApiFormatDefinition {
+        value: "gemini:cli",
+        label: "Gemini CLI",
+        default_path: "/v1beta/models/{model}:{action}",
+        aliases: &["gemini_cli", "gemini-cli"],
+    },
+    AdminApiFormatDefinition {
+        value: "gemini:video",
+        label: "Gemini Video",
+        default_path: "/v1beta/models/{model}:predictLongRunning",
+        aliases: &["gemini_video", "veo"],
+    },
+];
+
+pub(crate) fn current_aether_version() -> String {
+    let version_file =
+        std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../src/_version.py");
+    if let Ok(contents) = fs::read_to_string(version_file) {
+        for line in contents.lines() {
+            let line = line.trim();
+            if let Some(version) = line
+                .strip_prefix("__version__ = version = '")
+                .and_then(|value| value.strip_suffix('\''))
+            {
+                if !version.is_empty() {
+                    return version.to_string();
+                }
+            }
+        }
+    }
+
+    env!("CARGO_PKG_VERSION").to_string()
+}
+
+pub(crate) fn build_admin_system_check_update_payload() -> serde_json::Value {
+    json!({
+        "current_version": current_aether_version(),
+        "latest_version": serde_json::Value::Null,
+        "has_update": false,
+        "release_url": serde_json::Value::Null,
+        "release_notes": serde_json::Value::Null,
+        "published_at": serde_json::Value::Null,
+        "error": "检查更新需要 Rust 管理后端",
+    })
+}
+
+pub(crate) async fn build_admin_system_stats_payload(
+    state: &AppState,
+) -> Result<serde_json::Value, GatewayError> {
+    let providers = state
+        .list_provider_catalog_providers(false)
+        .await
+        .unwrap_or_default();
+    let total_providers = providers.len() as u64;
+    let active_providers = providers
+        .iter()
+        .filter(|provider| provider.is_active)
+        .count() as u64;
+    let stats = state.read_admin_system_stats().await?;
+
+    Ok(json!({
+        "users": {
+            "total": stats.total_users,
+            "active": stats.active_users,
+        },
+        "providers": {
+            "total": total_providers,
+            "active": active_providers,
+        },
+        "api_keys": stats.total_api_keys,
+        "requests": stats.total_requests,
+    }))
+}
+
+pub(crate) async fn build_admin_system_settings_payload(
+    state: &AppState,
+) -> Result<serde_json::Value, GatewayError> {
+    let default_provider_config = state
+        .read_system_config_json_value("default_provider")
+        .await?;
+    let default_model_config = state.read_system_config_json_value("default_model").await?;
+    let enable_usage_tracking_config = state
+        .read_system_config_json_value("enable_usage_tracking")
+        .await?;
+    let password_policy_level_config = state
+        .read_system_config_json_value("password_policy_level")
+        .await?;
+
+    let default_provider = match system_config_string(default_provider_config.as_ref()) {
+        Some(value) => Some(value),
+        None => state
+            .list_provider_catalog_providers(false)
+            .await
+            .ok()
+            .unwrap_or_default()
+            .into_iter()
+            .find(|provider| provider.is_active)
+            .map(|provider| provider.name),
+    };
+    let default_model = system_config_string(default_model_config.as_ref());
+    let enable_usage_tracking = system_config_bool(enable_usage_tracking_config.as_ref(), true);
+    let password_policy_level = match system_config_string(password_policy_level_config.as_ref()) {
+        Some(value) if matches!(value.as_str(), "weak" | "medium" | "strong") => value,
+        _ => "weak".to_string(),
+    };
+
+    Ok(json!({
+        "default_provider": default_provider,
+        "default_model": default_model,
+        "enable_usage_tracking": enable_usage_tracking,
+        "password_policy_level": password_policy_level,
+    }))
+}
+
+pub(crate) async fn apply_admin_system_settings_update(
+    state: &AppState,
+    request_body: &Bytes,
+) -> Result<Result<serde_json::Value, (http::StatusCode, serde_json::Value)>, GatewayError> {
+    let payload = match serde_json::from_slice::<serde_json::Value>(request_body) {
+        Ok(serde_json::Value::Object(payload)) => payload,
+        Ok(_) | Err(_) => {
+            return Ok(Err((
+                http::StatusCode::BAD_REQUEST,
+                json!({ "detail": "请求数据验证失败" }),
+            )));
+        }
+    };
+
+    if let Some(default_provider) = payload.get("default_provider") {
+        if let Some(default_provider) = default_provider.as_str() {
+            let default_provider = default_provider.trim();
+            if default_provider.is_empty() {
+                let _ = state
+                    .upsert_system_config_json_value(
+                        "default_provider",
+                        &serde_json::Value::Null,
+                        None,
+                    )
+                    .await?;
+            } else {
+                let provider_exists = state
+                    .list_provider_catalog_providers(false)
+                    .await
+                    .ok()
+                    .unwrap_or_default()
+                    .into_iter()
+                    .any(|provider| provider.is_active && provider.name == default_provider);
+                if !provider_exists {
+                    return Ok(Err((
+                        http::StatusCode::BAD_REQUEST,
+                        json!({ "detail": format!("提供商 '{default_provider}' 不存在或未启用") }),
+                    )));
+                }
+                let _ = state
+                    .upsert_system_config_json_value(
+                        "default_provider",
+                        &json!(default_provider),
+                        Some("系统默认提供商，当用户未设置个人提供商时使用"),
+                    )
+                    .await?;
+            }
+        } else if !default_provider.is_null() {
+            return Ok(Err((
+                http::StatusCode::BAD_REQUEST,
+                json!({ "detail": "请求数据验证失败" }),
+            )));
+        }
+    }
+
+    if let Some(default_model) = payload.get("default_model") {
+        if let Some(default_model) = default_model.as_str() {
+            let value = default_model.trim();
+            let config_value = if value.is_empty() {
+                serde_json::Value::Null
+            } else {
+                json!(value)
+            };
+            let _ = state
+                .upsert_system_config_json_value("default_model", &config_value, None)
+                .await?;
+        } else if !default_model.is_null() {
+            return Ok(Err((
+                http::StatusCode::BAD_REQUEST,
+                json!({ "detail": "请求数据验证失败" }),
+            )));
+        }
+    }
+
+    if let Some(enable_usage_tracking) = payload.get("enable_usage_tracking") {
+        if let Some(enable_usage_tracking) = enable_usage_tracking.as_bool() {
+            let _ = state
+                .upsert_system_config_json_value(
+                    "enable_usage_tracking",
+                    &json!(enable_usage_tracking),
+                    None,
+                )
+                .await?;
+        } else if !enable_usage_tracking.is_null() {
+            return Ok(Err((
+                http::StatusCode::BAD_REQUEST,
+                json!({ "detail": "请求数据验证失败" }),
+            )));
+        }
+    }
+
+    if let Some(password_policy_level) = payload.get("password_policy_level") {
+        if let Some(password_policy_level) = password_policy_level.as_str() {
+            if !matches!(password_policy_level.trim(), "weak" | "medium" | "strong") {
+                return Ok(Err((
+                    http::StatusCode::BAD_REQUEST,
+                    json!({ "detail": "请求数据验证失败" }),
+                )));
+            }
+            let _ = state
+                .upsert_system_config_json_value(
+                    "password_policy_level",
+                    &json!(password_policy_level.trim()),
+                    None,
+                )
+                .await?;
+        } else if !password_policy_level.is_null() {
+            return Ok(Err((
+                http::StatusCode::BAD_REQUEST,
+                json!({ "detail": "请求数据验证失败" }),
+            )));
+        }
+    }
+
+    Ok(Ok(json!({ "message": "系统设置更新成功" })))
+}
+
+pub(crate) fn build_admin_api_formats_payload() -> serde_json::Value {
+    json!({
+        "formats": ADMIN_API_FORMAT_DEFINITIONS
+            .iter()
+            .map(|definition| json!({
+                "value": definition.value,
+                "label": definition.label,
+                "default_path": definition.default_path,
+                "aliases": definition.aliases,
+            }))
+            .collect::<Vec<_>>(),
+    })
+}