feat(proxy): 实现代理节点批量升级回滚、隧道重定向跟随及远程配置管理

核心功能：
- 新增代理节点批量升级回滚工作流，支持分批升级、健康探针、跳过/重试/取消等操作
- proxy 隧道流处理器支持 HTTP 重定向跟随（最多 10 跳），区分 307/308 可重播与不可重播请求体
- proxy 协议新增 follow_redirects / http1_only 字段，网关侧同步支持
- 新增代理节点远端配置变更接口（名称、允许端口、调度状态、升级目标等）
- 新增代理节点注册/反注册/心跳的 Admin API，及节点过期清理维护任务
- gateway 隧道 owner-relay 支持流式代理大请求体，新增 5 MiB 默认限制
- 新增 ProxyNodeRegistrationMutation / ProxyNodeRemoteConfigMutation 数据类型
- proxy 配置新增重定向重播预算、心跳间隔等参数，TUI 安装向导同步更新
- 前端 ProxyNodes 页面新增批量升级操作面板及滚动进度展示

apps/aether-gateway/src/state/catalog.rs

@@ -86,6 +86,19 @@ impl AppState {
             .map_err(|err| GatewayError::Internal(err.to_string()))
     }
 
+    pub(crate) async fn get_management_token_with_user_by_hash(
+        &self,
+        token_hash: &str,
+    ) -> Result<
+        Option<aether_data::repository::management_tokens::StoredManagementTokenWithUser>,
+        GatewayError,
+    > {
+        self.data
+            .get_management_token_with_user_by_hash(token_hash)
+            .await
+            .map_err(|err| GatewayError::Internal(err.to_string()))
+    }
+
     pub(crate) async fn create_management_token(
         &self,
         record: &aether_data::repository::management_tokens::CreateManagementTokenRecord,
@@ -122,6 +135,20 @@ impl AppState {
             .map_err(|err| GatewayError::Internal(err.to_string()))
     }
 
+    pub(crate) async fn record_management_token_usage(
+        &self,
+        token_id: &str,
+        last_used_ip: Option<&str>,
+    ) -> Result<
+        Option<aether_data::repository::management_tokens::StoredManagementToken>,
+        GatewayError,
+    > {
+        self.data
+            .record_management_token_usage(token_id, last_used_ip)
+            .await
+            .map_err(|err| GatewayError::Internal(err.to_string()))
+    }
+
     pub(crate) async fn set_management_token_active(
         &self,
         token_id: &str,

apps/aether-gateway/src/state/core.rs

@@ -40,6 +40,8 @@ use crate::maintenance::spawn_gemini_file_mapping_cleanup_worker;
 use crate::maintenance::spawn_pending_cleanup_worker;
 use crate::maintenance::spawn_pool_monitor_worker;
 use crate::maintenance::spawn_provider_checkin_worker;
+use crate::maintenance::spawn_proxy_node_stale_cleanup_worker;
+use crate::maintenance::spawn_proxy_upgrade_rollout_worker;
 use crate::maintenance::spawn_request_candidate_cleanup_worker;
 use crate::maintenance::spawn_stats_aggregation_worker;
 use crate::maintenance::spawn_stats_hourly_aggregation_worker;
@@ -296,6 +298,10 @@ impl AppState {
         self.data.has_proxy_node_reader()
     }
 
+    pub(crate) fn has_proxy_node_writer(&self) -> bool {
+        self.data.has_proxy_node_writer()
+    }
+
     pub(crate) fn frontdoor_cors(&self) -> Option<Arc<FrontdoorCorsConfig>> {
         self.frontdoor_cors.clone()
     }
@@ -430,6 +436,23 @@ impl AppState {
             .map_err(|err| GatewayError::Internal(err.to_string()))
     }
 
+    pub(crate) async fn register_proxy_node(
+        &self,
+        mutation: &aether_data::repository::proxy_nodes::ProxyNodeRegistrationMutation,
+    ) -> Result<Option<StoredProxyNode>, GatewayError> {
+        self.data
+            .register_proxy_node(mutation)
+            .await
+            .map_err(|err| GatewayError::Internal(err.to_string()))
+    }
+
+    pub async fn reset_stale_proxy_node_tunnel_statuses(&self) -> std::io::Result<usize> {
+        self.data
+            .reset_stale_proxy_node_tunnel_statuses()
+            .await
+            .map_err(|err| std::io::Error::other(err.to_string()))
+    }
+
     pub(crate) async fn apply_proxy_node_heartbeat(
         &self,
         mutation: &ProxyNodeHeartbeatMutation,
@@ -440,6 +463,26 @@ impl AppState {
             .map_err(|err| GatewayError::Internal(err.to_string()))
     }
 
+    pub(crate) async fn unregister_proxy_node(
+        &self,
+        node_id: &str,
+    ) -> Result<Option<StoredProxyNode>, GatewayError> {
+        self.data
+            .unregister_proxy_node(node_id)
+            .await
+            .map_err(|err| GatewayError::Internal(err.to_string()))
+    }
+
+    pub(crate) async fn update_proxy_node_remote_config(
+        &self,
+        mutation: &aether_data::repository::proxy_nodes::ProxyNodeRemoteConfigMutation,
+    ) -> Result<Option<StoredProxyNode>, GatewayError> {
+        self.data
+            .update_proxy_node_remote_config(mutation)
+            .await
+            .map_err(|err| GatewayError::Internal(err.to_string()))
+    }
+
     pub(crate) async fn update_proxy_node_tunnel_status(
         &self,
         mutation: &ProxyNodeTunnelStatusMutation,
@@ -668,6 +711,12 @@ impl AppState {
         if let Some(handle) = spawn_pending_cleanup_worker(self.data.clone()) {
             tasks.push(handle);
         }
+        if let Some(handle) = spawn_proxy_node_stale_cleanup_worker(self.data.clone()) {
+            tasks.push(handle);
+        }
+        if let Some(handle) = spawn_proxy_upgrade_rollout_worker(self.clone()) {
+            tasks.push(handle);
+        }
         if let Some(handle) = spawn_provider_checkin_worker(self.clone()) {
             tasks.push(handle);
         }