refactor(rules): 规则引擎容错优化，无效规则条目跳过而非中止整个规则集

- header/body rules 的 _are_locally_supported 简化为仅检查是否为数组
- apply 逻辑中遇到格式错误/不支持的规则条目改为 continue 跳过，而非 return false
- 允许非字符串 header value，自动序列化为 JSON 字符串
- 宽松处理无效 regex flag，不再拒绝整条规则

fix(gateway): Claude CLI 路由仅检查 bearer 头，不排斥同时携带 x-api-key 的请求

feat(observability): 监控链路候选展示解密 auth_config 的账号标签和 OAuth 计划类型

apps/aether-gateway/src/control/tests/ai.rs

@@ -52,6 +52,41 @@ fn classifies_claude_messages_cli_when_bearer_without_api_key() {
     assert!(decision.is_execution_runtime_candidate());
 }
 
+#[test]
+fn classifies_claude_messages_cli_when_bearer_is_present_even_with_api_key() {
+    let headers = headers(&[
+        ("authorization", "Bearer token-123"),
+        ("x-api-key", "sk-client"),
+    ]);
+    let uri: Uri = "/v1/messages".parse().expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_family.as_deref(), Some("claude"));
+    assert_eq!(decision.route_kind.as_deref(), Some("cli"));
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("claude:cli")
+    );
+    assert!(decision.is_execution_runtime_candidate());
+}
+
+#[test]
+fn classifies_claude_messages_chat_when_api_key_without_bearer() {
+    let headers = headers(&[("x-api-key", "sk-client")]);
+    let uri: Uri = "/v1/messages".parse().expect("uri should parse");
+    let decision =
+        classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
+
+    assert_eq!(decision.route_family.as_deref(), Some("claude"));
+    assert_eq!(decision.route_kind.as_deref(), Some("chat"));
+    assert_eq!(
+        decision.auth_endpoint_signature.as_deref(),
+        Some("claude:chat")
+    );
+    assert!(decision.is_execution_runtime_candidate());
+}
+
 #[test]
 fn classifies_gemini_cli_generate_content_when_x_app_contains_cli() {
     let headers = headers(&[("x-app", "Gemini-CLI")]);