feat(gateway): Codex/OpenAI Responses WebSocket 代理模式

在 /v1/responses 上支持 WebSocket 升级，把客户端帧中继到上游 Codex /
OpenAI Responses WebSocket 端点，同时保持既有的路由、鉴权、配额与用量
语义：

- 路由与准入：control/route/ai.rs 识别 WebSocket 升级请求；
  websocket/ingress.rs 复用 API Key 鉴权、IP 规则与并发许可，并引入
  独立的 WebSocket 连接许可
- 中继：websocket/responses/* 按 connection / session / turn 分层，
  帧解析归一化、socket 写入有界、continuation 保持调度亲和性
- 配额：orchestration/codex_quota_breaker.rs 在账号配额耗尽时熔断并
  自动恢复，不再直接断开客户端连接
- 用量：每个 turn 的终态用量落库，request_metadata 记录
  websocket_mode / websocket_transport，管理端与 usage 视图暴露
  is_websocket
- 管理端：provider 可配置 Responses WebSocket 开关

apps/aether-gateway/src/api/core.rs

@@ -50,12 +50,40 @@ pub(crate) async fn health(State(state): State<AppState>) -> impl IntoResponse {
                 "rejected": snapshot.rejected,
             })
         });
+    let websocket_connection_concurrency =
+        state
+            .websocket_connection_concurrency_snapshot()
+            .map(|snapshot| {
+                json!({
+                    "limit": snapshot.limit,
+                    "in_flight": snapshot.in_flight,
+                    "available_permits": snapshot.available_permits,
+                    "high_watermark": snapshot.high_watermark,
+                    "rejected": snapshot.rejected,
+                })
+            });
+    let distributed_websocket_connection_concurrency = state
+        .distributed_websocket_connection_concurrency_snapshot()
+        .await
+        .ok()
+        .flatten()
+        .map(|snapshot| {
+            json!({
+                "limit": snapshot.limit,
+                "in_flight": snapshot.in_flight,
+                "available_permits": snapshot.available_permits,
+                "high_watermark": snapshot.high_watermark,
+                "rejected": snapshot.rejected,
+            })
+        });
     Json(json!({
         "status": "ok",
         "component": "aether-gateway",
         "control_api_enabled": true,
         "request_concurrency": request_concurrency,
         "distributed_request_concurrency": distributed_request_concurrency,
+        "websocket_connection_concurrency": websocket_connection_concurrency,
+        "distributed_websocket_connection_concurrency": distributed_websocket_connection_concurrency,
     }))
 }
 
@@ -113,6 +141,12 @@ pub(crate) async fn frontdoor_manifest(State(state): State<AppState>) -> impl In
             "execution_runtime_configured": state.execution_runtime_configured(),
             "request_concurrency_enabled": state.request_concurrency_snapshot().is_some(),
             "distributed_request_concurrency_enabled": state.distributed_request_gate.is_some(),
+            "websocket_connection_concurrency_enabled": state
+                .websocket_connection_concurrency_snapshot()
+                .is_some(),
+            "distributed_websocket_connection_concurrency_enabled": state
+                .distributed_websocket_connection_gate
+                .is_some(),
             "frontdoor_cors_enabled": cors_enabled,
             "frontdoor_cors_allow_credentials": cors_allow_credentials,
             "frontdoor_cors_allowed_origins": cors_allowed_origins,