feat(proxy): 实现代理节点批量升级回滚、隧道重定向跟随及远程配置管理

核心功能：
- 新增代理节点批量升级回滚工作流，支持分批升级、健康探针、跳过/重试/取消等操作
- proxy 隧道流处理器支持 HTTP 重定向跟随（最多 10 跳），区分 307/308 可重播与不可重播请求体
- proxy 协议新增 follow_redirects / http1_only 字段，网关侧同步支持
- 新增代理节点远端配置变更接口（名称、允许端口、调度状态、升级目标等）
- 新增代理节点注册/反注册/心跳的 Admin API，及节点过期清理维护任务
- gateway 隧道 owner-relay 支持流式代理大请求体，新增 5 MiB 默认限制
- 新增 ProxyNodeRegistrationMutation / ProxyNodeRemoteConfigMutation 数据类型
- proxy 配置新增重定向重播预算、心跳间隔等参数，TUI 安装向导同步更新
- 前端 ProxyNodes 页面新增批量升级操作面板及滚动进度展示

apps/aether-gateway/src/maintenance/runtime/runners.rs

@@ -1,15 +1,18 @@
 use aether_data_contracts::DataLayerError;
-use tracing::info;
+use tracing::{info, warn};
 
 use crate::data::GatewayDataState;
 use crate::{AppState, GatewayError};
 
 use super::{
-    cleanup_audit_logs_once, cleanup_expired_gemini_file_mappings_once,
-    cleanup_request_candidates_once, cleanup_stale_pending_requests_once,
-    perform_db_maintenance_once, perform_provider_checkin_once, perform_stats_aggregation_once,
+    advance_proxy_upgrade_rollout_once, cleanup_audit_logs_once,
+    cleanup_expired_gemini_file_mappings_once, cleanup_request_candidates_once,
+    cleanup_stale_pending_requests_once, cleanup_stale_proxy_nodes_once,
+    collect_proxy_upgrade_rollout_probes, perform_db_maintenance_once,
+    perform_provider_checkin_once, perform_stats_aggregation_once,
     perform_stats_hourly_aggregation_once, perform_usage_cleanup_once,
-    perform_wallet_daily_usage_aggregation_once, summarize_postgres_pool,
+    perform_wallet_daily_usage_aggregation_once, record_proxy_upgrade_traffic_success,
+    summarize_postgres_pool,
 };
 
 pub(super) async fn run_audit_cleanup_once(data: &GatewayDataState) -> Result<(), DataLayerError> {
@@ -42,6 +45,91 @@ pub(super) async fn run_gemini_file_mapping_cleanup_once(
     Ok(())
 }
 
+pub(super) async fn run_proxy_node_stale_cleanup_once(
+    data: &GatewayDataState,
+) -> Result<(), DataLayerError> {
+    let stale_marked = cleanup_stale_proxy_nodes_once(data).await?;
+    if stale_marked > 0 {
+        info!(
+            event_name = "proxy_node_stale_cleanup_completed",
+            log_type = "ops",
+            worker = "proxy_node_stale_cleanup",
+            stale_marked,
+            "gateway marked stale proxy nodes offline"
+        );
+    }
+    Ok(())
+}
+
+pub(super) async fn run_proxy_upgrade_rollout_once(state: &AppState) -> Result<(), DataLayerError> {
+    let mut summary = advance_proxy_upgrade_rollout_once(&state.data).await?;
+    let probes = collect_proxy_upgrade_rollout_probes(&state.data).await?;
+    let mut probe_recorded = false;
+    for probe in probes {
+        match state
+            .tunnel
+            .probe_node_url(&probe.node_id, &probe.url, probe.timeout_secs)
+            .await
+        {
+            Ok(status) if (200..300).contains(&status) => {
+                let _ = record_proxy_upgrade_traffic_success(&state.data, &probe.node_id).await?;
+                probe_recorded = true;
+                info!(
+                    event_name = "proxy_upgrade_rollout_probe_succeeded",
+                    log_type = "ops",
+                    worker = "proxy_upgrade_rollout",
+                    node_id = %probe.node_id,
+                    url = %probe.url,
+                    status,
+                    "gateway confirmed proxy upgrade health probe"
+                );
+            }
+            Ok(status) => {
+                warn!(
+                    event_name = "proxy_upgrade_rollout_probe_unhealthy",
+                    log_type = "ops",
+                    worker = "proxy_upgrade_rollout",
+                    node_id = %probe.node_id,
+                    url = %probe.url,
+                    status,
+                    "gateway proxy upgrade health probe returned non-success status"
+                );
+            }
+            Err(error) => {
+                warn!(
+                    event_name = "proxy_upgrade_rollout_probe_failed",
+                    log_type = "ops",
+                    worker = "proxy_upgrade_rollout",
+                    node_id = %probe.node_id,
+                    url = %probe.url,
+                    error = %error,
+                    "gateway proxy upgrade health probe failed"
+                );
+            }
+        }
+    }
+
+    if probe_recorded {
+        summary = advance_proxy_upgrade_rollout_once(&state.data).await?;
+    }
+    if summary.updated > 0 || !summary.pending_node_ids.is_empty() || !summary.version.is_empty() {
+        info!(
+            event_name = "proxy_upgrade_rollout_checked",
+            log_type = "ops",
+            worker = "proxy_upgrade_rollout",
+            version = %summary.version,
+            updated = summary.updated,
+            blocked = summary.blocked,
+            pending = summary.pending_node_ids.len(),
+            completed = summary.completed,
+            remaining = summary.remaining,
+            rollout_active = summary.rollout_active,
+            "gateway checked proxy upgrade rollout"
+        );
+    }
+    Ok(())
+}
+
 pub(super) async fn run_db_maintenance_once(data: &GatewayDataState) -> Result<(), DataLayerError> {
     let summary = perform_db_maintenance_once(data).await?;
     if summary.attempted > 0 {