refactor: 移除独立 hub/proxy/executor/gateway crate，统一为 gateway tunnel 架构

- 删除 aether-hub、aether-proxy 独立项目及其 Dockerfile/配置
- 删除 crates/aether-executor 和 crates/aether-gateway 全部模块
- 新增 apps/ 目录作为应用入口
- 将 hub 概念重构为 gateway tunnel transport
- 将 executor 重构为 execution runtime
- 新增 tunnel.rs 合约定义和 testkit tunnel/execution_runtime 模块
- 更新 Python 服务层和测试适配新架构命名

apps/aether-gateway/src/control/tests/admin_provider_ops.rs

@@ -0,0 +1,318 @@
+use super::*;
+
+#[test]
+fn classifies_admin_provider_ops_architectures_list_as_admin_proxy_route() {
+    let headers = headers(&[]);
+    let uri: Uri = "/api/admin/provider-ops/architectures?limit=20"
+        .parse()
+        .expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::GET, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_class.as_deref(), Some("admin_proxy"));
+    assert_eq!(
+        decision.route_family.as_deref(),
+        Some("provider_ops_manage")
+    );
+    assert_eq!(decision.route_kind.as_deref(), Some("list_architectures"));
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("admin:provider_ops")
+    );
+    assert!(!decision.is_execution_runtime_candidate());
+}
+
+#[test]
+fn classifies_admin_provider_ops_architecture_detail_as_admin_proxy_route() {
+    let headers = headers(&[]);
+    let uri: Uri = "/api/admin/provider-ops/architectures/generic_api"
+        .parse()
+        .expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::GET, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_class.as_deref(), Some("admin_proxy"));
+    assert_eq!(
+        decision.route_family.as_deref(),
+        Some("provider_ops_manage")
+    );
+    assert_eq!(decision.route_kind.as_deref(), Some("get_architecture"));
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("admin:provider_ops")
+    );
+    assert!(!decision.is_execution_runtime_candidate());
+}
+
+#[test]
+fn classifies_admin_provider_ops_provider_status_as_admin_proxy_route() {
+    let headers = headers(&[]);
+    let uri: Uri = "/api/admin/provider-ops/providers/provider-openai/status"
+        .parse()
+        .expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::GET, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_class.as_deref(), Some("admin_proxy"));
+    assert_eq!(
+        decision.route_family.as_deref(),
+        Some("provider_ops_manage")
+    );
+    assert_eq!(decision.route_kind.as_deref(), Some("get_provider_status"));
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("admin:provider_ops")
+    );
+    assert!(!decision.is_execution_runtime_candidate());
+}
+
+#[test]
+fn classifies_admin_provider_ops_provider_config_as_admin_proxy_route() {
+    let headers = headers(&[]);
+    let uri: Uri = "/api/admin/provider-ops/providers/provider-openai/config"
+        .parse()
+        .expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::GET, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_class.as_deref(), Some("admin_proxy"));
+    assert_eq!(
+        decision.route_family.as_deref(),
+        Some("provider_ops_manage")
+    );
+    assert_eq!(decision.route_kind.as_deref(), Some("get_provider_config"));
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("admin:provider_ops")
+    );
+    assert!(!decision.is_execution_runtime_candidate());
+}
+
+#[test]
+fn classifies_admin_provider_ops_save_provider_config_as_admin_proxy_route() {
+    let headers = headers(&[]);
+    let uri: Uri = "/api/admin/provider-ops/providers/provider-openai/config"
+        .parse()
+        .expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::PUT, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_class.as_deref(), Some("admin_proxy"));
+    assert_eq!(
+        decision.route_family.as_deref(),
+        Some("provider_ops_manage")
+    );
+    assert_eq!(decision.route_kind.as_deref(), Some("save_provider_config"));
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("admin:provider_ops")
+    );
+    assert!(!decision.is_execution_runtime_candidate());
+}
+
+#[test]
+fn classifies_admin_provider_ops_delete_provider_config_as_admin_proxy_route() {
+    let headers = headers(&[]);
+    let uri: Uri = "/api/admin/provider-ops/providers/provider-openai/config"
+        .parse()
+        .expect("uri should parse");
+    let decision = classify_control_route(&http::Method::DELETE, &uri, &headers)
+        .expect("route should classify");
+
+    assert_eq!(decision.route_class.as_deref(), Some("admin_proxy"));
+    assert_eq!(
+        decision.route_family.as_deref(),
+        Some("provider_ops_manage")
+    );
+    assert_eq!(
+        decision.route_kind.as_deref(),
+        Some("delete_provider_config")
+    );
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("admin:provider_ops")
+    );
+    assert!(!decision.is_execution_runtime_candidate());
+}
+
+#[test]
+fn classifies_admin_provider_ops_disconnect_provider_as_admin_proxy_route() {
+    let headers = headers(&[]);
+    let uri: Uri = "/api/admin/provider-ops/providers/provider-openai/disconnect"
+        .parse()
+        .expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_class.as_deref(), Some("admin_proxy"));
+    assert_eq!(
+        decision.route_family.as_deref(),
+        Some("provider_ops_manage")
+    );
+    assert_eq!(decision.route_kind.as_deref(), Some("disconnect_provider"));
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("admin:provider_ops")
+    );
+    assert!(!decision.is_execution_runtime_candidate());
+}
+
+#[test]
+fn classifies_admin_provider_ops_connect_provider_as_admin_proxy_route() {
+    let headers = headers(&[]);
+    let uri: Uri = "/api/admin/provider-ops/providers/provider-openai/connect"
+        .parse()
+        .expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_class.as_deref(), Some("admin_proxy"));
+    assert_eq!(
+        decision.route_family.as_deref(),
+        Some("provider_ops_manage")
+    );
+    assert_eq!(decision.route_kind.as_deref(), Some("connect_provider"));
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("admin:provider_ops")
+    );
+    assert!(!decision.is_execution_runtime_candidate());
+}
+
+#[test]
+fn classifies_admin_provider_ops_verify_provider_as_admin_proxy_route() {
+    let headers = headers(&[]);
+    let uri: Uri = "/api/admin/provider-ops/providers/provider-openai/verify"
+        .parse()
+        .expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_class.as_deref(), Some("admin_proxy"));
+    assert_eq!(
+        decision.route_family.as_deref(),
+        Some("provider_ops_manage")
+    );
+    assert_eq!(decision.route_kind.as_deref(), Some("verify_provider"));
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("admin:provider_ops")
+    );
+    assert!(!decision.is_execution_runtime_candidate());
+}
+
+#[test]
+fn classifies_admin_provider_ops_get_balance_as_admin_proxy_route() {
+    let headers = headers(&[]);
+    let uri: Uri = "/api/admin/provider-ops/providers/provider-openai/balance"
+        .parse()
+        .expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::GET, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_class.as_deref(), Some("admin_proxy"));
+    assert_eq!(
+        decision.route_family.as_deref(),
+        Some("provider_ops_manage")
+    );
+    assert_eq!(decision.route_kind.as_deref(), Some("get_provider_balance"));
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("admin:provider_ops")
+    );
+    assert!(!decision.is_execution_runtime_candidate());
+}
+
+#[test]
+fn classifies_admin_provider_ops_refresh_balance_as_admin_proxy_route() {
+    let headers = headers(&[]);
+    let uri: Uri = "/api/admin/provider-ops/providers/provider-openai/balance"
+        .parse()
+        .expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_class.as_deref(), Some("admin_proxy"));
+    assert_eq!(
+        decision.route_family.as_deref(),
+        Some("provider_ops_manage")
+    );
+    assert_eq!(
+        decision.route_kind.as_deref(),
+        Some("refresh_provider_balance")
+    );
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("admin:provider_ops")
+    );
+    assert!(!decision.is_execution_runtime_candidate());
+}
+
+#[test]
+fn classifies_admin_provider_ops_checkin_as_admin_proxy_route() {
+    let headers = headers(&[]);
+    let uri: Uri = "/api/admin/provider-ops/providers/provider-openai/checkin"
+        .parse()
+        .expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_class.as_deref(), Some("admin_proxy"));
+    assert_eq!(
+        decision.route_family.as_deref(),
+        Some("provider_ops_manage")
+    );
+    assert_eq!(decision.route_kind.as_deref(), Some("provider_checkin"));
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("admin:provider_ops")
+    );
+    assert!(!decision.is_execution_runtime_candidate());
+}
+
+#[test]
+fn classifies_admin_provider_ops_execute_action_as_admin_proxy_route() {
+    let headers = headers(&[]);
+    let uri: Uri = "/api/admin/provider-ops/providers/provider-openai/actions/query_balance"
+        .parse()
+        .expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_class.as_deref(), Some("admin_proxy"));
+    assert_eq!(
+        decision.route_family.as_deref(),
+        Some("provider_ops_manage")
+    );
+    assert_eq!(
+        decision.route_kind.as_deref(),
+        Some("execute_provider_action")
+    );
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("admin:provider_ops")
+    );
+    assert!(!decision.is_execution_runtime_candidate());
+}
+
+#[test]
+fn classifies_admin_provider_ops_batch_balance_as_admin_proxy_route() {
+    let headers = headers(&[]);
+    let uri: Uri = "/api/admin/provider-ops/batch/balance"
+        .parse()
+        .expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_class.as_deref(), Some("admin_proxy"));
+    assert_eq!(
+        decision.route_family.as_deref(),
+        Some("provider_ops_manage")
+    );
+    assert_eq!(decision.route_kind.as_deref(), Some("batch_balance"));
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("admin:provider_ops")
+    );
+    assert!(!decision.is_execution_runtime_candidate());
+}