refactor: 大规模模块拆分与代码精简，新增 ai-pipeline/data-contracts 独立 crate

- 新增 aether-ai-pipeline 和 aether-data-contracts crate，将 pipeline 逻辑与数据契约从 gateway 中解耦
- 重构 admin handlers：拆分单体模块为 auth/billing/endpoint/features/model/observability/provider/system 等独立子模块
- 合并 chat/cli 重复代码路径：精简 conversion、finalize、planner 中的 sync/chat/cli 分支
- 重构 scheduler/executor/data 层，引入 facade 模式降低模块间耦合
- 移除冗余的 intent 模块，将 plan_fallback/policy/stream_path/sync_path 迁移至 executor
- 前端适配：调整 admin API 调用和 provider 模型测试对话框

apps/aether-gateway/src/handlers/admin/users/api_keys.rs

@@ -4,10 +4,9 @@ use super::{
     AdminToggleUserApiKeyLockRequest, AdminUpdateUserApiKeyRequest,
 };
 use crate::control::GatewayPublicRequestContext;
-use crate::handlers::admin::misc_helpers::attach_admin_audit_response;
-use crate::handlers::{
-    decrypt_catalog_secret_with_fallbacks, encrypt_catalog_secret_with_fallbacks,
-    query_param_optional_bool,
+use crate::handlers::admin::shared::{
+    attach_admin_audit_response, decrypt_catalog_secret_with_fallbacks,
+    encrypt_catalog_secret_with_fallbacks, query_param_optional_bool,
 };
 use crate::{AppState, GatewayError};
 use axum::{
@@ -198,8 +197,10 @@ pub(super) async fn build_admin_list_user_api_keys_response(
         .map(|record| record.api_key_id.clone())
         .collect::<Vec<_>>();
     let snapshot_by_id = state
-        .read_auth_api_key_snapshots_by_ids(&snapshot_ids)
-        .await?
+        .data
+        .list_auth_api_key_snapshots_by_ids(&snapshot_ids)
+        .await
+        .map_err(|err| GatewayError::Internal(err.to_string()))?
         .into_iter()
         .map(|snapshot| (snapshot.api_key_id.clone(), snapshot))
         .collect::<std::collections::BTreeMap<_, _>>();
@@ -241,7 +242,7 @@ pub(super) async fn build_admin_create_user_api_key_response(
     request_context: &GatewayPublicRequestContext,
     request_body: Option<&axum::body::Bytes>,
 ) -> Result<Response<Body>, GatewayError> {
-    if !state.has_auth_api_key_writer() {
+    if !state.data.has_auth_api_key_writer() {
         return Ok(build_admin_users_read_only_response(
             "当前为只读模式，无法创建用户 API Key",
         ));
@@ -381,7 +382,7 @@ pub(super) async fn build_admin_update_user_api_key_response(
     request_context: &GatewayPublicRequestContext,
     request_body: Option<&axum::body::Bytes>,
 ) -> Result<Response<Body>, GatewayError> {
-    if !state.has_auth_api_key_writer() {
+    if !state.data.has_auth_api_key_writer() {
         return Ok(build_admin_users_read_only_response(
             "当前为只读模式，无法更新用户 API Key",
         ));
@@ -445,8 +446,10 @@ pub(super) async fn build_admin_update_user_api_key_response(
     };
 
     let is_locked = state
-        .read_auth_api_key_snapshots_by_ids(std::slice::from_ref(&api_key_id))
-        .await?
+        .data
+        .list_auth_api_key_snapshots_by_ids(std::slice::from_ref(&api_key_id))
+        .await
+        .map_err(|err| GatewayError::Internal(err.to_string()))?
         .into_iter()
         .find(|snapshot| snapshot.api_key_id == api_key_id)
         .map(|snapshot| snapshot.api_key_is_locked)
@@ -466,7 +469,7 @@ pub(super) async fn build_admin_delete_user_api_key_response(
     state: &AppState,
     request_context: &GatewayPublicRequestContext,
 ) -> Result<Response<Body>, GatewayError> {
-    if !state.has_auth_api_key_writer() {
+    if !state.data.has_auth_api_key_writer() {
         return Ok(build_admin_users_read_only_response(
             "当前为只读模式，无法删除用户 API Key",
         ));
@@ -500,7 +503,7 @@ pub(super) async fn build_admin_toggle_user_api_key_lock_response(
     request_context: &GatewayPublicRequestContext,
     request_body: Option<&axum::body::Bytes>,
 ) -> Result<Response<Body>, GatewayError> {
-    if !state.has_auth_api_key_writer() {
+    if !state.data.has_auth_api_key_writer() {
         return Ok(build_admin_users_read_only_response(
             "当前为只读模式，无法锁定或解锁用户 API Key",
         ));
@@ -514,8 +517,10 @@ pub(super) async fn build_admin_toggle_user_api_key_lock_response(
     };
 
     let Some(snapshot) = state
-        .read_auth_api_key_snapshots_by_ids(std::slice::from_ref(&api_key_id))
-        .await?
+        .data
+        .list_auth_api_key_snapshots_by_ids(std::slice::from_ref(&api_key_id))
+        .await
+        .map_err(|err| GatewayError::Internal(err.to_string()))?
         .into_iter()
         .find(|snapshot| snapshot.user_id == user_id && snapshot.api_key_id == api_key_id)
     else {

apps/aether-gateway/src/handlers/admin/users/lifecycle.rs

@@ -7,8 +7,9 @@ use super::{
     AdminUpdateUserFieldPresence, AdminUpdateUserRequest,
 };
 use crate::control::GatewayPublicRequestContext;
-use crate::handlers::admin::misc_helpers::attach_admin_audit_response;
-use crate::handlers::{query_param_optional_bool, query_param_value};
+use crate::handlers::admin::shared::{
+    attach_admin_audit_response, query_param_optional_bool, query_param_value,
+};
 use crate::{AppState, GatewayError};
 use axum::{
     body::Body,

apps/aether-gateway/src/handlers/admin/users/mod.rs

@@ -0,0 +1,49 @@
+use crate::control::GatewayPublicRequestContext;
+use crate::{AppState, GatewayError};
+use axum::{body::Body, response::Response};
+
+const ADMIN_USERS_DATA_UNAVAILABLE_DETAIL: &str = "Admin user management data unavailable";
+
+mod api_keys;
+mod lifecycle;
+mod routes;
+mod sessions;
+mod shared;
+
+use self::api_keys::{
+    build_admin_create_user_api_key_response, build_admin_delete_user_api_key_response,
+    build_admin_list_user_api_keys_response, build_admin_reveal_user_api_key_response,
+    build_admin_toggle_user_api_key_lock_response, build_admin_update_user_api_key_response,
+};
+pub(crate) use self::api_keys::{
+    default_admin_user_api_key_name, format_optional_unix_secs_iso8601,
+    generate_admin_user_api_key_plaintext, hash_admin_user_api_key, masked_user_api_key_display,
+    normalize_admin_optional_api_key_name,
+};
+use self::lifecycle::{
+    build_admin_create_user_response, build_admin_delete_user_response,
+    build_admin_get_user_response, build_admin_list_users_response,
+    build_admin_update_user_response,
+};
+use self::sessions::{
+    build_admin_delete_user_session_response, build_admin_delete_user_sessions_response,
+    build_admin_list_user_sessions_response,
+};
+use self::shared::{
+    admin_default_user_initial_gift, build_admin_users_bad_request_response,
+    build_admin_users_data_unavailable_response, build_admin_users_read_only_response,
+    format_optional_datetime_iso8601, normalize_admin_optional_user_email,
+    normalize_admin_user_role, normalize_admin_username, validate_admin_user_password,
+    AdminCreateUserApiKeyRequest, AdminCreateUserRequest, AdminToggleUserApiKeyLockRequest,
+    AdminUpdateUserApiKeyRequest, AdminUpdateUserFieldPresence, AdminUpdateUserRequest,
+};
+pub(crate) use self::shared::{normalize_admin_user_api_formats, normalize_admin_user_string_list};
+
+pub(crate) async fn maybe_build_local_admin_users_response(
+    state: &AppState,
+    request_context: &GatewayPublicRequestContext,
+    request_body: Option<&axum::body::Bytes>,
+) -> Result<Option<Response<Body>>, GatewayError> {
+    routes::maybe_build_local_admin_users_routes_response(state, request_context, request_body)
+        .await
+}

apps/aether-gateway/src/handlers/admin/users/sessions.rs

@@ -1,7 +1,7 @@
 use super::{build_admin_users_bad_request_response, format_optional_datetime_iso8601};
 use crate::control::GatewayPublicRequestContext;
-use crate::handlers::admin::misc_helpers::attach_admin_audit_response;
-use crate::{AppState, GatewayError};
+use crate::handlers::admin::shared::attach_admin_audit_response;
+use crate::{AppState, GatewayError, GatewayUserSessionView};
 use axum::{
     body::Body,
     http,
@@ -34,9 +34,7 @@ fn admin_user_session_parts(request_path: &str) -> Option<(String, String)> {
     }
 }
 
-fn format_required_session_datetime_iso8601(
-    session: &crate::data::state::StoredUserSessionRecord,
-) -> String {
+fn format_required_session_datetime_iso8601(session: &GatewayUserSessionView) -> String {
     session
         .created_at
         .or(session.updated_at)