feat(gateway): Codex/OpenAI Responses WebSocket 代理模式

在 /v1/responses 上支持 WebSocket 升级，把客户端帧中继到上游 Codex /
OpenAI Responses WebSocket 端点，同时保持既有的路由、鉴权、配额与用量
语义：

- 路由与准入：control/route/ai.rs 识别 WebSocket 升级请求；
  websocket/ingress.rs 复用 API Key 鉴权、IP 规则与并发许可，并引入
  独立的 WebSocket 连接许可
- 中继：websocket/responses/* 按 connection / session / turn 分层，
  帧解析归一化、socket 写入有界、continuation 保持调度亲和性
- 配额：orchestration/codex_quota_breaker.rs 在账号配额耗尽时熔断并
  自动恢复，不再直接断开客户端连接
- 用量：每个 turn 的终态用量落库，request_metadata 记录
  websocket_mode / websocket_transport，管理端与 usage 视图暴露
  is_websocket
- 管理端：provider 可配置 Responses WebSocket 开关

apps/aether-gateway/src/provider_pool_demand.rs

@@ -68,12 +68,14 @@ impl ProviderPoolInFlightGuard {
         if self.released {
             return;
         }
-        self.released = true;
         match &mut self.kind {
             ProviderPoolInFlightGuardKind::Local {
                 provider_id,
                 counter,
-            } => decrement_local_provider_in_flight(provider_id, counter),
+            } => {
+                self.released = true;
+                decrement_local_provider_in_flight(provider_id, counter);
+            }
             ProviderPoolInFlightGuardKind::Runtime {
                 runtime,
                 tokens_key,
@@ -85,11 +87,17 @@ impl ProviderPoolInFlightGuard {
                 if let Some(handle) = renew_handle.take() {
                     handle.abort();
                 }
-                if let Err(err) = runtime.score_remove(tokens_key, token).await {
-                    debug!(
-                        error = ?err,
-                        "gateway provider pool demand: failed to release in-flight token"
-                    );
+                // Mark the guard released only after Redis confirms removal.
+                // If this future is cancelled, Drop still schedules the same
+                // idempotent cleanup instead of leaving the token until TTL.
+                match runtime.score_remove(tokens_key, token).await {
+                    Ok(_) => self.released = true,
+                    Err(err) => {
+                        debug!(
+                            error = ?err,
+                            "gateway provider pool demand: failed to release in-flight token; scheduling drop fallback"
+                        );
+                    }
                 }
             }
         }