refactor(workspace): enforce layered crate boundaries

apps/aether-gateway/src/state/runtime/auth/api_keys.rs

@@ -13,7 +13,7 @@ const AUTH_API_KEY_SNAPSHOT_RUNTIME_CACHE_TTL: Duration = Duration::from_secs(30
 use super::super::super::{AUTH_API_KEY_LAST_USED_MAX_ENTRIES, AUTH_API_KEY_LAST_USED_TTL};
 
 impl AppState {
-    async fn acquire_auth_snapshot_load_gate(
+    pub(crate) async fn acquire_auth_snapshot_load_gate(
         &self,
     ) -> Result<Option<aether_runtime::ConcurrencyPermit>, GatewayError> {
         let Some(gate) = self.auth_snapshot_load_gate.as_ref() else {

apps/aether-gateway/src/state/runtime/billing/admin.rs

@@ -525,12 +525,27 @@ impl AppState {
         }
         let ttl = self.frontdoor_runtime_guards.auth_capacity_cache_ttl;
         if ttl.is_zero() {
-            return self.find_user_daily_quota_availability(user_id).await;
+            return self
+                .find_user_daily_quota_availability_for_auth_uncached(user_id)
+                .await;
         }
         self.auth_daily_quota_availability_cache
             .get_or_load(user_id.to_string(), ttl, || async move {
+                let _permit = self.acquire_auth_snapshot_load_gate().await?;
                 self.find_user_daily_quota_availability(user_id).await
             })
             .await
     }
+
+    pub(crate) async fn find_user_daily_quota_availability_for_auth_uncached(
+        &self,
+        user_id: &str,
+    ) -> Result<Option<UserDailyQuotaAvailabilityRecord>, GatewayError> {
+        let user_id = user_id.trim();
+        if user_id.is_empty() {
+            return Ok(None);
+        }
+        let _permit = self.acquire_auth_snapshot_load_gate().await?;
+        self.find_user_daily_quota_availability(user_id).await
+    }
 }

apps/aether-gateway/src/state/runtime/usage_queries.rs

@@ -181,6 +181,16 @@ impl AppState {
             .map_err(|err| GatewayError::Internal(err.to_string()))
     }
 
+    pub(crate) async fn summarize_dashboard_stats(
+        &self,
+        query: &usage::UsageDashboardSummaryQuery,
+    ) -> Result<usage::StoredUsageDashboardStatsSummary, GatewayError> {
+        self.data
+            .summarize_dashboard_stats(query)
+            .await
+            .map_err(|err| GatewayError::Internal(err.to_string()))
+    }
+
     pub(crate) async fn list_dashboard_daily_breakdown(
         &self,
         query: &usage::UsageDashboardDailyBreakdownQuery,

apps/aether-gateway/src/state/runtime/wallet/reads.rs

@@ -73,15 +73,16 @@ impl AppState {
 
         let ttl = self.frontdoor_runtime_guards.auth_capacity_cache_ttl;
         if ttl.is_zero() {
-            return self.find_wallet(lookup).await;
+            return self
+                .read_wallet_snapshot_for_auth_uncached(user_id, api_key_id, api_key_is_standalone)
+                .await;
         }
 
         self.auth_wallet_snapshot_cache
-            .get_or_load(
-                cache_key,
-                ttl,
-                || async move { self.find_wallet(lookup).await },
-            )
+            .get_or_load(cache_key, ttl, || async move {
+                let _permit = self.acquire_auth_snapshot_load_gate().await?;
+                self.find_wallet(lookup).await
+            })
             .await
     }
 
@@ -117,6 +118,7 @@ impl AppState {
             return Ok(None);
         };
 
+        let _permit = self.acquire_auth_snapshot_load_gate().await?;
         self.find_wallet(lookup).await
     }