refactor: 移除独立 hub/proxy/executor/gateway crate，统一为 gateway tunnel 架构

- 删除 aether-hub、aether-proxy 独立项目及其 Dockerfile/配置
- 删除 crates/aether-executor 和 crates/aether-gateway 全部模块
- 新增 apps/ 目录作为应用入口
- 将 hub 概念重构为 gateway tunnel transport
- 将 executor 重构为 execution runtime
- 新增 tunnel.rs 合约定义和 testkit tunnel/execution_runtime 模块
- 更新 Python 服务层和测试适配新架构命名

apps/aether-gateway/src/control/tests/ai.rs

@@ -0,0 +1,87 @@
+use super::*;
+
+#[test]
+fn classifies_claude_count_tokens_as_non_execution_runtime_public_route() {
+    let headers = headers(&[("x-api-key", "sk-test")]);
+    let uri: Uri = "/v1/messages/count_tokens"
+        .parse()
+        .expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_family.as_deref(), Some("claude"));
+    assert_eq!(decision.route_kind.as_deref(), Some("count_tokens"));
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("claude:chat")
+    );
+    assert!(!decision.is_execution_runtime_candidate());
+}
+
+#[test]
+fn classifies_models_list_as_claude_when_headers_match() {
+    let headers = headers(&[
+        ("x-api-key", "sk-claude"),
+        ("anthropic-version", "2023-06-01"),
+    ]);
+    let uri: Uri = "/v1/models".parse().expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::GET, &uri, &headers).expect("route should classify");
+
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("claude:chat")
+    );
+}
+
+#[test]
+fn classifies_claude_messages_cli_when_bearer_without_api_key() {
+    let headers = headers(&[("authorization", "Bearer token-123")]);
+    let uri: Uri = "/v1/messages".parse().expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_family.as_deref(), Some("claude"));
+    assert_eq!(decision.route_kind.as_deref(), Some("cli"));
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("claude:cli")
+    );
+    assert!(decision.is_execution_runtime_candidate());
+}
+
+#[test]
+fn classifies_gemini_cli_generate_content_when_x_app_contains_cli() {
+    let headers = headers(&[("x-app", "Gemini-CLI")]);
+    let uri: Uri = "/v1beta/models/gemini-2.5-pro:generateContent"
+        .parse()
+        .expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_family.as_deref(), Some("gemini"));
+    assert_eq!(decision.route_kind.as_deref(), Some("cli"));
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("gemini:cli")
+    );
+    assert!(decision.is_execution_runtime_candidate());
+}
+
+#[test]
+fn classifies_gemini_predict_long_running_as_video_route() {
+    let headers = headers(&[]);
+    let uri: Uri = "/v1beta/models/veo-3:predictLongRunning"
+        .parse()
+        .expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_family.as_deref(), Some("gemini"));
+    assert_eq!(decision.route_kind.as_deref(), Some("video"));
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("gemini:video")
+    );
+    assert!(decision.is_execution_runtime_candidate());
+}