Unify quota snapshots and oauth refresh handling

apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/batch/execution.rs

@@ -11,7 +11,8 @@ use crate::handlers::admin::provider::oauth::provisioning::{
     update_existing_provider_oauth_catalog_key,
 };
 use crate::handlers::admin::provider::oauth::runtime::{
-    provider_oauth_runtime_endpoint_for_provider, refresh_provider_oauth_account_state_after_update,
+    provider_oauth_runtime_endpoint_for_provider,
+    spawn_provider_oauth_account_state_refresh_after_update,
 };
 use crate::handlers::admin::provider::oauth::state::{
     admin_provider_oauth_template, exchange_admin_provider_oauth_refresh_token,
@@ -264,9 +265,12 @@ pub(super) async fn execute_admin_provider_oauth_batch_import(
             }
         };
 
-        let _ =
-            refresh_provider_oauth_account_state_after_update(state, &provider, &persisted_key.id)
-                .await;
+        spawn_provider_oauth_account_state_refresh_after_update(
+            state.cloned_app(),
+            provider.clone(),
+            persisted_key.id.clone(),
+            request_proxy.clone(),
+        );
 
         success += 1;
         results.push(json!({

apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/batch/kiro_import.rs

@@ -5,7 +5,8 @@ use crate::handlers::admin::provider::oauth::provisioning::{
     update_existing_provider_oauth_catalog_key,
 };
 use crate::handlers::admin::provider::oauth::runtime::{
-    provider_oauth_runtime_endpoint_for_provider, refresh_provider_oauth_account_state_after_update,
+    provider_oauth_runtime_endpoint_for_provider,
+    spawn_provider_oauth_account_state_refresh_after_update,
 };
 use crate::handlers::admin::provider::oauth::state::decode_jwt_claims;
 use crate::handlers::admin::provider::shared::support::ADMIN_PROVIDER_OAUTH_DATA_UNAVAILABLE_DETAIL;
@@ -548,9 +549,12 @@ pub(super) async fn execute_admin_provider_oauth_kiro_batch_import(
             .get("auth_method")
             .cloned()
             .unwrap_or(serde_json::Value::Null);
-        let _ =
-            refresh_provider_oauth_account_state_after_update(state, &provider, &persisted_key.id)
-                .await;
+        spawn_provider_oauth_account_state_refresh_after_update(
+            state.cloned_app(),
+            provider.clone(),
+            persisted_key.id.clone(),
+            request_proxy.clone(),
+        );
 
         success += 1;
         results.push(json!({

apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/complete/key.rs

@@ -148,7 +148,7 @@ pub(super) async fn handle_admin_provider_oauth_complete_key(
             &callback.code,
             &callback.state_nonce,
             state_data.pkce_verifier.as_deref(),
-            request_proxy,
+            request_proxy.clone(),
         )
         .await
     {
@@ -243,6 +243,7 @@ pub(super) async fn handle_admin_provider_oauth_complete_key(
                 &provider,
                 &endpoint,
                 vec![refreshed_key],
+                request_proxy.clone(),
             )
             .await?
             {

apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/complete/provider.rs

@@ -5,7 +5,8 @@ use super::super::super::provisioning::{
     provider_oauth_active_api_formats, update_existing_provider_oauth_catalog_key,
 };
 use super::super::super::runtime::{
-    provider_oauth_runtime_endpoint_for_provider, refresh_provider_oauth_account_state_after_update,
+    provider_oauth_runtime_endpoint_for_provider,
+    spawn_provider_oauth_account_state_refresh_after_update,
 };
 use super::super::super::state::{
     admin_provider_oauth_template, build_admin_provider_oauth_backend_unavailable_response,
@@ -137,7 +138,7 @@ pub(super) async fn handle_admin_provider_oauth_complete_provider(
             &callback.code,
             &callback.state_nonce,
             state_data.pkce_verifier.as_deref(),
-            request_proxy,
+            request_proxy.clone(),
         )
         .await
     {
@@ -231,9 +232,12 @@ pub(super) async fn handle_admin_provider_oauth_complete_provider(
         }
     };
 
-    let _ = state
-        .refresh_provider_oauth_account_state_after_update(&provider, &persisted_key.id)
-        .await;
+    spawn_provider_oauth_account_state_refresh_after_update(
+        state.cloned_app(),
+        provider.clone(),
+        persisted_key.id.clone(),
+        request_proxy.clone(),
+    );
 
     Ok(Json(json!({
         "key_id": persisted_key.id,

apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/device/poll.rs

@@ -8,7 +8,8 @@ use crate::handlers::admin::provider::oauth::provisioning::{
     update_existing_provider_oauth_catalog_key,
 };
 use crate::handlers::admin::provider::oauth::runtime::{
-    provider_oauth_runtime_endpoint_for_provider, refresh_provider_oauth_account_state_after_update,
+    provider_oauth_runtime_endpoint_for_provider,
+    spawn_provider_oauth_account_state_refresh_after_update,
 };
 use crate::handlers::admin::provider::oauth::state::{
     build_admin_provider_oauth_backend_unavailable_response, build_kiro_device_key_name,
@@ -149,7 +150,7 @@ pub(super) async fn handle_admin_provider_oauth_device_poll(
             &session.client_id,
             &session.client_secret,
             &session.device_code,
-            request_proxy,
+            request_proxy.clone(),
         )
         .await
     {
@@ -315,9 +316,12 @@ pub(super) async fn handle_admin_provider_oauth_device_poll(
         }
     };
 
-    let _ = state
-        .refresh_provider_oauth_account_state_after_update(&provider, &persisted_key.id)
-        .await;
+    spawn_provider_oauth_account_state_refresh_after_update(
+        state.cloned_app(),
+        provider.clone(),
+        persisted_key.id.clone(),
+        request_proxy.clone(),
+    );
 
     session.status = "authorized".to_string();
     session.key_id = Some(persisted_key.id.clone());

apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/import.rs

@@ -5,7 +5,8 @@ use super::super::provisioning::{
     provider_oauth_active_api_formats, update_existing_provider_oauth_catalog_key,
 };
 use super::super::runtime::{
-    provider_oauth_runtime_endpoint_for_provider, refresh_provider_oauth_account_state_after_update,
+    provider_oauth_runtime_endpoint_for_provider,
+    spawn_provider_oauth_account_state_refresh_after_update,
 };
 use super::super::state::{
     admin_provider_oauth_template, build_admin_provider_oauth_backend_unavailable_response,
@@ -120,7 +121,11 @@ pub(super) async fn handle_admin_provider_oauth_import_refresh_token(
         .await;
 
     let token_payload = match state
-        .exchange_admin_provider_oauth_refresh_token(template, refresh_token_input, request_proxy)
+        .exchange_admin_provider_oauth_refresh_token(
+            template,
+            refresh_token_input,
+            request_proxy.clone(),
+        )
         .await
     {
         Ok(payload) => payload,
@@ -218,9 +223,12 @@ pub(super) async fn handle_admin_provider_oauth_import_refresh_token(
         }
     };
 
-    let _ = state
-        .refresh_provider_oauth_account_state_after_update(&provider, &persisted_key.id)
-        .await;
+    spawn_provider_oauth_account_state_refresh_after_update(
+        state.cloned_app(),
+        provider.clone(),
+        persisted_key.id.clone(),
+        request_proxy.clone(),
+    );
 
     Ok(Json(json!({
         "key_id": persisted_key.id,

apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/refresh/execution.rs

@@ -94,7 +94,7 @@ pub(super) async fn execute_admin_provider_oauth_refresh(
         refreshed_key.encrypted_auth_config.as_deref(),
     );
     let (account_state_recheck_attempted, account_state_recheck_error) = state
-        .refresh_provider_oauth_account_state_after_update(&provider, &key_id)
+        .refresh_provider_oauth_account_state_after_update(&provider, &key_id, None)
         .await?;
 
     Ok(RefreshDispatch::Continue(RefreshSuccessContext {