refactor(workspace): enforce layered crate boundaries

apps/aether-gateway/src/state/runtime/billing/admin.rs

@@ -525,12 +525,27 @@ impl AppState {
         }
         let ttl = self.frontdoor_runtime_guards.auth_capacity_cache_ttl;
         if ttl.is_zero() {
-            return self.find_user_daily_quota_availability(user_id).await;
+            return self
+                .find_user_daily_quota_availability_for_auth_uncached(user_id)
+                .await;
         }
         self.auth_daily_quota_availability_cache
             .get_or_load(user_id.to_string(), ttl, || async move {
+                let _permit = self.acquire_auth_snapshot_load_gate().await?;
                 self.find_user_daily_quota_availability(user_id).await
             })
             .await
     }
+
+    pub(crate) async fn find_user_daily_quota_availability_for_auth_uncached(
+        &self,
+        user_id: &str,
+    ) -> Result<Option<UserDailyQuotaAvailabilityRecord>, GatewayError> {
+        let user_id = user_id.trim();
+        if user_id.is_empty() {
+            return Ok(None);
+        }
+        let _permit = self.acquire_auth_snapshot_load_gate().await?;
+        self.find_user_daily_quota_availability(user_id).await
+    }
 }