feat(proxy): 重构 Proxy 节点管理与隧道系统

- 重构 proxy_nodes 管理端，支持节点注册、心跳、隧道生命周期管理
- 增强 tunnel 嵌入式 hub 和隧道协议
- 重构 aether-proxy 配置、隧道客户端、心跳和调度机制
- 调整 admin OAuth/配额/导入等处理器的参数传递
- 扩展数据迁移模块
- 补充 proxy nodes、OAuth、配额、系统导入等测试
- 更新前端 proxy nodes 视图和 API

apps/aether-gateway/src/handlers/admin/provider/oauth/state/exchange.rs

@@ -3,16 +3,25 @@ use super::super::errors::{
 };
 use super::json_non_empty_string;
 use crate::handlers::admin::request::{AdminAppState, AdminProviderOAuthTemplate};
+use aether_contracts::ProxySnapshot;
 use axum::{body::Body, http, response::Response};
 use url::form_urlencoded;
 
+fn provider_oauth_transport_error_detail(prefix: &str, error: &str) -> String {
+    let error = error.trim();
+    if error.is_empty() {
+        return prefix.to_string();
+    }
+    format!("{prefix}: {error}")
+}
+
 pub(crate) async fn exchange_admin_provider_oauth_code(
     state: &AdminAppState<'_>,
     template: AdminProviderOAuthTemplate,
     code: &str,
     state_nonce: &str,
     pkce_verifier: Option<&str>,
-    proxy_node_id: Option<&str>,
+    proxy: Option<ProxySnapshot>,
 ) -> Result<serde_json::Value, Response<Body>> {
     let token_url = state.provider_oauth_token_url(template.provider_type, template.token_url);
     let response = if template.provider_type == "claude_code" {
@@ -63,7 +72,7 @@ pub(crate) async fn exchange_admin_provider_oauth_code(
                 Some("application/json"),
                 Some(serde_json::Value::Object(body)),
                 None,
-                proxy_node_id,
+                proxy.clone(),
             )
             .await
     } else {
@@ -100,12 +109,15 @@ pub(crate) async fn exchange_admin_provider_oauth_code(
                 Some("application/x-www-form-urlencoded"),
                 None,
                 Some(form_body),
-                proxy_node_id,
+                proxy.clone(),
             )
             .await
     }
-    .map_err(|_| {
-        build_internal_control_error_response(http::StatusCode::BAD_REQUEST, "token exchange 失败")
+    .map_err(|error| {
+        build_internal_control_error_response(
+            http::StatusCode::BAD_REQUEST,
+            provider_oauth_transport_error_detail("token exchange 失败", &error),
+        )
     })?;
 
     if !response.status.is_success() {
@@ -134,7 +146,7 @@ pub(crate) async fn exchange_admin_provider_oauth_refresh_token(
     state: &AdminAppState<'_>,
     template: AdminProviderOAuthTemplate,
     refresh_token: &str,
-    proxy_node_id: Option<&str>,
+    proxy: Option<ProxySnapshot>,
 ) -> Result<serde_json::Value, Response<Body>> {
     let token_url = state.provider_oauth_token_url(template.provider_type, template.token_url);
     let scope = template.scopes.join(" ");
@@ -175,7 +187,7 @@ pub(crate) async fn exchange_admin_provider_oauth_refresh_token(
                 Some("application/json"),
                 Some(serde_json::Value::Object(body)),
                 None,
-                proxy_node_id,
+                proxy.clone(),
             )
             .await
     } else {
@@ -211,14 +223,17 @@ pub(crate) async fn exchange_admin_provider_oauth_refresh_token(
                 Some("application/x-www-form-urlencoded"),
                 None,
                 Some(form_body),
-                proxy_node_id,
+                proxy.clone(),
             )
             .await
     }
-    .map_err(|_| {
+    .map_err(|error| {
         build_internal_control_error_response(
             http::StatusCode::BAD_REQUEST,
-            "Refresh Token 验证失败: token exchange 失败",
+            provider_oauth_transport_error_detail(
+                "Refresh Token 验证失败: token exchange 失败",
+                &error,
+            ),
         )
     })?;