refactor: 大规模模块拆分与代码精简，新增 ai-pipeline/data-contracts 独立 crate

- 新增 aether-ai-pipeline 和 aether-data-contracts crate，将 pipeline 逻辑与数据契约从 gateway 中解耦
- 重构 admin handlers：拆分单体模块为 auth/billing/endpoint/features/model/observability/provider/system 等独立子模块
- 合并 chat/cli 重复代码路径：精简 conversion、finalize、planner 中的 sync/chat/cli 分支
- 重构 scheduler/executor/data 层，引入 facade 模式降低模块间耦合
- 移除冗余的 intent 模块，将 plan_fallback/policy/stream_path/sync_path 迁移至 executor
- 前端适配：调整 admin API 调用和 provider 模型测试对话框

crates/aether-crypto/src/lib.rs

@@ -2,6 +2,6 @@ mod python_fernet;
 
 pub use python_fernet::{
     decrypt_python_fernet_ciphertext, derive_python_fernet_key, encrypt_python_fernet_plaintext,
-    looks_like_python_fernet_ciphertext, PythonFernetCompat, PythonFernetError, APP_SALT_HEX,
-    APP_SALT_SEED, DEVELOPMENT_ENCRYPTION_KEY,
+    looks_like_python_fernet_ciphertext, warm_python_fernet_secret, PythonFernetCompat,
+    PythonFernetError, APP_SALT_HEX, APP_SALT_SEED, DEVELOPMENT_ENCRYPTION_KEY,
 };

crates/aether-crypto/src/python_fernet.rs

@@ -1,3 +1,5 @@
+use std::collections::HashMap;
+use std::sync::{LazyLock, Mutex};
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use aes::cipher::{block_padding::Pkcs7, BlockDecryptMut, BlockEncryptMut, KeyIvInit};
@@ -16,11 +18,15 @@ const SIGNING_KEY_SIZE: usize = 16;
 const ENCRYPTION_KEY_SIZE: usize = 16;
 const MIN_TOKEN_SIZE: usize = 1 + 8 + IV_SIZE + HMAC_SIZE;
 const PBKDF2_ITERATIONS: u32 = 100_000;
+const MAX_CACHED_DERIVED_KEYS: usize = 16;
 
 pub const APP_SALT_SEED: &[u8] = b"aether-v1";
 pub const APP_SALT_HEX: &str = "8797080a7a4b45b4810e934d1af36261";
 pub const DEVELOPMENT_ENCRYPTION_KEY: &str = "dev-encryption-key-do-not-use-in-production";
 
+static RAW_FERNET_KEY_CACHE: LazyLock<Mutex<HashMap<Box<str>, [u8; 32]>>> =
+    LazyLock::new(|| Mutex::new(HashMap::new()));
+
 type Aes128CbcDec = Decryptor<aes::Aes128>;
 type Aes128CbcEnc = Encryptor<aes::Aes128>;
 type HmacSha256 = Hmac<Sha256>;
@@ -179,16 +185,37 @@ pub fn encrypt_python_fernet_plaintext(
     PythonFernetCompat::from_secret(secret).encrypt_plaintext(plaintext)
 }
 
+pub fn warm_python_fernet_secret(secret: &str) {
+    let _ = raw_fernet_key(secret);
+}
+
 fn raw_fernet_key(secret: &str) -> [u8; 32] {
     if let Ok(raw_key) = decode_direct_fernet_key(secret) {
         return raw_key;
     }
 
+    if let Some(raw_key) = RAW_FERNET_KEY_CACHE
+        .lock()
+        .expect("raw fernet key cache should lock")
+        .get(secret)
+        .copied()
+    {
+        return raw_key;
+    }
+
     let mut salt = [0u8; 16];
     salt.copy_from_slice(&Sha256::digest(APP_SALT_SEED)[..16]);
 
     let mut raw_key = [0u8; 32];
     pbkdf2_hmac::<Sha256>(secret.as_bytes(), &salt, PBKDF2_ITERATIONS, &mut raw_key);
+
+    let mut cache = RAW_FERNET_KEY_CACHE
+        .lock()
+        .expect("raw fernet key cache should lock");
+    if cache.len() >= MAX_CACHED_DERIVED_KEYS && !cache.contains_key(secret) {
+        cache.clear();
+    }
+    cache.insert(secret.into(), raw_key);
     raw_key
 }