refactor: 移除独立 hub/proxy/executor/gateway crate，统一为 gateway tunnel 架构

- 删除 aether-hub、aether-proxy 独立项目及其 Dockerfile/配置
- 删除 crates/aether-executor 和 crates/aether-gateway 全部模块
- 新增 apps/ 目录作为应用入口
- 将 hub 概念重构为 gateway tunnel transport
- 将 executor 重构为 execution runtime
- 新增 tunnel.rs 合约定义和 testkit tunnel/execution_runtime 模块
- 更新 Python 服务层和测试适配新架构命名

apps/aether-gateway/src/handlers/admin/users.rs

@@ -0,0 +1,59 @@
+use super::*;
+
+const ADMIN_USERS_RUST_BACKEND_DETAIL: &str =
+    "Admin user management routes require Rust maintenance backend";
+
+#[path = "users/api_keys.rs"]
+mod users_api_keys;
+#[path = "users/lifecycle.rs"]
+mod users_lifecycle;
+#[path = "users/routes.rs"]
+mod users_routes;
+#[path = "users/sessions.rs"]
+mod users_sessions;
+#[path = "users/shared.rs"]
+mod users_shared;
+
+use self::users_api_keys::{
+    build_admin_create_user_api_key_response, build_admin_delete_user_api_key_response,
+    build_admin_list_user_api_keys_response, build_admin_reveal_user_api_key_response,
+    build_admin_toggle_user_api_key_lock_response, build_admin_update_user_api_key_response,
+};
+pub(crate) use self::users_api_keys::{
+    default_admin_user_api_key_name, format_optional_unix_secs_iso8601,
+    generate_admin_user_api_key_plaintext, hash_admin_user_api_key, masked_user_api_key_display,
+    normalize_admin_optional_api_key_name,
+};
+use self::users_lifecycle::{
+    build_admin_create_user_response, build_admin_delete_user_response,
+    build_admin_get_user_response, build_admin_list_users_response,
+    build_admin_update_user_response,
+};
+use self::users_sessions::{
+    build_admin_delete_user_session_response, build_admin_delete_user_sessions_response,
+    build_admin_list_user_sessions_response,
+};
+use self::users_shared::{
+    admin_default_user_initial_gift, build_admin_users_bad_request_response,
+    build_admin_users_maintenance_response, build_admin_users_read_only_response,
+    format_optional_datetime_iso8601, normalize_admin_optional_user_email,
+    normalize_admin_user_role, normalize_admin_username, validate_admin_user_password,
+    AdminCreateUserApiKeyRequest, AdminCreateUserRequest, AdminToggleUserApiKeyLockRequest,
+    AdminUpdateUserApiKeyRequest, AdminUpdateUserFieldPresence, AdminUpdateUserRequest,
+};
+pub(crate) use self::users_shared::{
+    normalize_admin_user_api_formats, normalize_admin_user_string_list,
+};
+
+pub(crate) async fn maybe_build_local_admin_users_response(
+    state: &AppState,
+    request_context: &GatewayPublicRequestContext,
+    request_body: Option<&axum::body::Bytes>,
+) -> Result<Option<Response<Body>>, GatewayError> {
+    users_routes::maybe_build_local_admin_users_routes_response(
+        state,
+        request_context,
+        request_body,
+    )
+    .await
+}