feat(gateway): Codex/OpenAI Responses WebSocket 代理模式

在 /v1/responses 上支持 WebSocket 升级，把客户端帧中继到上游 Codex /
OpenAI Responses WebSocket 端点，同时保持既有的路由、鉴权、配额与用量
语义：

- 路由与准入：control/route/ai.rs 识别 WebSocket 升级请求；
  websocket/ingress.rs 复用 API Key 鉴权、IP 规则与并发许可，并引入
  独立的 WebSocket 连接许可
- 中继：websocket/responses/* 按 connection / session / turn 分层，
  帧解析归一化、socket 写入有界、continuation 保持调度亲和性
- 配额：orchestration/codex_quota_breaker.rs 在账号配额耗尽时熔断并
  自动恢复，不再直接断开客户端连接
- 用量：每个 turn 的终态用量落库，request_metadata 记录
  websocket_mode / websocket_transport，管理端与 usage 视图暴露
  is_websocket
- 管理端：provider 可配置 Responses WebSocket 开关

apps/aether-gateway/src/execution_runtime/admission.rs

@@ -0,0 +1,62 @@
+//! Shared admission helpers for local upstream execution.
+//!
+//! The stream candidate loop and long-lived WebSocket turns both need to
+//! participate in the same gateway-wide upstream execution gate.  Keep the
+//! provider abstraction here so tests can supply an isolated gate while
+//! production callers use `AppState` directly.
+
+use std::time::Duration;
+
+use aether_runtime::{ConcurrencyGate, ConcurrencyPermit};
+use tokio::time::timeout;
+
+use crate::stage_metrics::observe_gateway_stage_ms;
+use crate::{AppState, GatewayError};
+
+pub(crate) const UPSTREAM_EXECUTION_GATE_NAME: &str = "gateway_upstream_execution";
+
+pub(crate) trait UpstreamExecutionGateProvider {
+    fn upstream_execution_gate(&self) -> Option<&ConcurrencyGate>;
+    fn upstream_execution_gate_queue_budget(&self) -> Duration;
+}
+
+impl UpstreamExecutionGateProvider for AppState {
+    fn upstream_execution_gate(&self) -> Option<&ConcurrencyGate> {
+        self.upstream_execution_gate.as_deref()
+    }
+
+    fn upstream_execution_gate_queue_budget(&self) -> Duration {
+        self.frontdoor_runtime_guards.internal_gate_queue_budget
+    }
+}
+
+/// Acquires the shared gateway-wide upstream execution permit.
+///
+/// A missing gate is an intentional configuration (unlimited), so callers
+/// receive `Ok(None)`.  Saturation keeps the existing candidate-level
+/// `AdmissionTimeout` contract used by the HTTP stream path.
+pub(crate) async fn acquire_upstream_execution_gate(
+    state: &(impl UpstreamExecutionGateProvider + ?Sized),
+    trace_id: &str,
+) -> Result<Option<ConcurrencyPermit>, GatewayError> {
+    let Some(gate) = state.upstream_execution_gate() else {
+        return Ok(None);
+    };
+    let budget = state.upstream_execution_gate_queue_budget();
+    let gate_wait_started_at = std::time::Instant::now();
+    match timeout(budget, gate.acquire()).await {
+        Ok(Ok(permit)) => {
+            observe_gateway_stage_ms(
+                "upstream_execution_gate_wait",
+                gate_wait_started_at.elapsed().as_millis() as u64,
+            );
+            Ok(Some(permit))
+        }
+        Ok(Err(err)) => Err(GatewayError::Internal(err.to_string())),
+        Err(_) => Err(GatewayError::AdmissionTimeout {
+            trace_id: trace_id.to_string(),
+            gate: UPSTREAM_EXECUTION_GATE_NAME,
+            queue_budget_ms: budget.as_millis() as u64,
+        }),
+    }
+}