refactor: 大规模模块拆分与代码精简，新增 ai-pipeline/data-contracts 独立 crate

- 新增 aether-ai-pipeline 和 aether-data-contracts crate，将 pipeline 逻辑与数据契约从 gateway 中解耦
- 重构 admin handlers：拆分单体模块为 auth/billing/endpoint/features/model/observability/provider/system 等独立子模块
- 合并 chat/cli 重复代码路径：精简 conversion、finalize、planner 中的 sync/chat/cli 分支
- 重构 scheduler/executor/data 层，引入 facade 模式降低模块间耦合
- 移除冗余的 intent 模块，将 plan_fallback/policy/stream_path/sync_path 迁移至 executor
- 前端适配：调整 admin API 调用和 provider 模型测试对话框

apps/aether-gateway/src/handlers/admin/users/mod.rs

@@ -0,0 +1,49 @@
+use crate::control::GatewayPublicRequestContext;
+use crate::{AppState, GatewayError};
+use axum::{body::Body, response::Response};
+
+const ADMIN_USERS_DATA_UNAVAILABLE_DETAIL: &str = "Admin user management data unavailable";
+
+mod api_keys;
+mod lifecycle;
+mod routes;
+mod sessions;
+mod shared;
+
+use self::api_keys::{
+    build_admin_create_user_api_key_response, build_admin_delete_user_api_key_response,
+    build_admin_list_user_api_keys_response, build_admin_reveal_user_api_key_response,
+    build_admin_toggle_user_api_key_lock_response, build_admin_update_user_api_key_response,
+};
+pub(crate) use self::api_keys::{
+    default_admin_user_api_key_name, format_optional_unix_secs_iso8601,
+    generate_admin_user_api_key_plaintext, hash_admin_user_api_key, masked_user_api_key_display,
+    normalize_admin_optional_api_key_name,
+};
+use self::lifecycle::{
+    build_admin_create_user_response, build_admin_delete_user_response,
+    build_admin_get_user_response, build_admin_list_users_response,
+    build_admin_update_user_response,
+};
+use self::sessions::{
+    build_admin_delete_user_session_response, build_admin_delete_user_sessions_response,
+    build_admin_list_user_sessions_response,
+};
+use self::shared::{
+    admin_default_user_initial_gift, build_admin_users_bad_request_response,
+    build_admin_users_data_unavailable_response, build_admin_users_read_only_response,
+    format_optional_datetime_iso8601, normalize_admin_optional_user_email,
+    normalize_admin_user_role, normalize_admin_username, validate_admin_user_password,
+    AdminCreateUserApiKeyRequest, AdminCreateUserRequest, AdminToggleUserApiKeyLockRequest,
+    AdminUpdateUserApiKeyRequest, AdminUpdateUserFieldPresence, AdminUpdateUserRequest,
+};
+pub(crate) use self::shared::{normalize_admin_user_api_formats, normalize_admin_user_string_list};
+
+pub(crate) async fn maybe_build_local_admin_users_response(
+    state: &AppState,
+    request_context: &GatewayPublicRequestContext,
+    request_body: Option<&axum::body::Bytes>,
+) -> Result<Option<Response<Body>>, GatewayError> {
+    routes::maybe_build_local_admin_users_routes_response(state, request_context, request_body)
+        .await
+}