feat: 引入 aether-runtime/cache/data/http/testkit 基础 crate，完善并发门控与审计系统

新增 crate：
- aether-runtime: 服务运行时基础设施（并发门控、分布式并发、指标、队列、优雅关闭、tracing）
- aether-cache: 通用 TTL 缓存与命名空间抽象
- aether-data: 数据访问层（PostgreSQL/Redis 后端、repository 模式）
- aether-http: HTTP 客户端封装（重试、配置）
- aether-testkit: 集成测试工具集（gateway/executor/hub/proxy fixture、等待、负载测试）

gateway 扩展：
- 引入 audit 模块（shadow 执行审计、决策链路追踪、请求审计 bundle）
- 引入 cache 模块（AuthContext 缓存、direct-plan bypass 缓存）
- 引入 data 模块（auth/candidates/config/usage/video_tasks 数据访问）
- 集成 ConcurrencyGate/DistributedConcurrencyGate 请求门控
- 新增本地 auth 拒绝、过载响应构建器
- 补充 control/auth_cache/video/concurrency 集成测试

aether-proxy 扩展：
- AppState 集成 stream_gate / distributed_stream_gate 并发门控
- 新增 ProxyAdmissionError 及准入拒绝流程
- stream_handler 补充门控饱和/不可用场景测试
- 配置与注册客户端逻辑完善

aether-hub 扩展：
- main.rs 引入运行时初始化、指标端点、健康检查
- local_relay 重构为 lib.rs 暴露公共接口

crates/aether-http/Cargo.toml

@@ -0,0 +1,11 @@
+[package]
+name = "aether-http"
+version = "0.1.0"
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+description = "Shared HTTP client config and retry helpers for Aether Rust services"
+
+[dependencies]
+reqwest.workspace = true
+serde.workspace = true

crates/aether-http/src/client.rs

@@ -0,0 +1,75 @@
+use std::time::Duration;
+
+use reqwest::header::HeaderMap;
+
+use crate::HttpClientConfig;
+
+pub fn apply_http_client_config(
+    mut builder: reqwest::ClientBuilder,
+    config: &HttpClientConfig,
+) -> reqwest::ClientBuilder {
+    if config.use_rustls_tls {
+        builder = builder.use_rustls_tls();
+    }
+    if let Some(timeout_ms) = config.connect_timeout_ms {
+        builder = builder.connect_timeout(Duration::from_millis(timeout_ms));
+    }
+    if let Some(timeout_ms) = config.request_timeout_ms {
+        builder = builder.timeout(Duration::from_millis(timeout_ms));
+    }
+    if let Some(timeout_ms) = config.pool_idle_timeout_ms {
+        builder = builder.pool_idle_timeout(Duration::from_millis(timeout_ms));
+    }
+    if let Some(max_idle) = config.pool_max_idle_per_host {
+        builder = builder.pool_max_idle_per_host(max_idle);
+    }
+
+    builder = builder.tcp_keepalive(config.tcp_keepalive_ms.map(Duration::from_millis));
+    builder = builder.tcp_nodelay(config.tcp_nodelay);
+
+    if config.http2_adaptive_window {
+        builder = builder.http2_adaptive_window(true);
+    }
+    if let Some(user_agent) = &config.user_agent {
+        builder = builder.user_agent(user_agent.clone());
+    }
+
+    builder
+}
+
+pub fn build_http_client(config: &HttpClientConfig) -> Result<reqwest::Client, reqwest::Error> {
+    build_http_client_with_headers(config, HeaderMap::new())
+}
+
+pub fn build_http_client_with_headers(
+    config: &HttpClientConfig,
+    default_headers: HeaderMap,
+) -> Result<reqwest::Client, reqwest::Error> {
+    let mut builder = apply_http_client_config(reqwest::Client::builder(), config);
+    if !default_headers.is_empty() {
+        builder = builder.default_headers(default_headers);
+    }
+    builder.build()
+}
+
+#[cfg(test)]
+mod tests {
+    use reqwest::header::{HeaderMap, HeaderValue};
+
+    use super::build_http_client_with_headers;
+    use crate::HttpClientConfig;
+
+    #[test]
+    fn builds_client_with_default_headers() {
+        let mut headers = HeaderMap::new();
+        headers.insert("x-test", HeaderValue::from_static("ok"));
+        let config = HttpClientConfig {
+            connect_timeout_ms: Some(100),
+            request_timeout_ms: Some(500),
+            ..HttpClientConfig::default()
+        };
+
+        let client = build_http_client_with_headers(&config, headers);
+        assert!(client.is_ok());
+    }
+}

crates/aether-http/src/config.rs

@@ -0,0 +1,109 @@
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize, PartialEq, Eq)]
+pub struct HttpClientConfig {
+    pub connect_timeout_ms: Option<u64>,
+    pub request_timeout_ms: Option<u64>,
+    pub pool_idle_timeout_ms: Option<u64>,
+    pub pool_max_idle_per_host: Option<usize>,
+    pub tcp_keepalive_ms: Option<u64>,
+    pub tcp_nodelay: bool,
+    pub http2_adaptive_window: bool,
+    pub use_rustls_tls: bool,
+    pub user_agent: Option<String>,
+}
+
+impl Default for HttpClientConfig {
+    fn default() -> Self {
+        Self {
+            connect_timeout_ms: None,
+            request_timeout_ms: None,
+            pool_idle_timeout_ms: None,
+            pool_max_idle_per_host: None,
+            tcp_keepalive_ms: None,
+            tcp_nodelay: true,
+            http2_adaptive_window: false,
+            use_rustls_tls: true,
+            user_agent: None,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, serde::Serialize, serde::Deserialize, PartialEq, Eq)]
+pub struct HttpRetryConfig {
+    pub max_attempts: u32,
+    pub base_delay_ms: u64,
+    pub max_delay_ms: u64,
+}
+
+impl Default for HttpRetryConfig {
+    fn default() -> Self {
+        Self {
+            max_attempts: 3,
+            base_delay_ms: 200,
+            max_delay_ms: 2_000,
+        }
+    }
+}
+
+impl HttpRetryConfig {
+    pub fn normalized(self) -> Self {
+        let max_attempts = self.max_attempts.max(1);
+        let base_delay_ms = self.base_delay_ms.max(1);
+        let max_delay_ms = self.max_delay_ms.max(base_delay_ms);
+        Self {
+            max_attempts,
+            base_delay_ms,
+            max_delay_ms,
+        }
+    }
+
+    pub fn delay_for_retry(self, retry_index: u32) -> std::time::Duration {
+        let config = self.normalized();
+        let factor = 2_u64.saturating_pow(retry_index.min(20));
+        let delay_ms = config
+            .base_delay_ms
+            .saturating_mul(factor)
+            .min(config.max_delay_ms);
+        std::time::Duration::from_millis(delay_ms)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::HttpRetryConfig;
+
+    #[test]
+    fn normalizes_retry_bounds() {
+        let config = HttpRetryConfig {
+            max_attempts: 0,
+            base_delay_ms: 0,
+            max_delay_ms: 5,
+        }
+        .normalized();
+
+        assert_eq!(config.max_attempts, 1);
+        assert_eq!(config.base_delay_ms, 1);
+        assert_eq!(config.max_delay_ms, 5);
+    }
+
+    #[test]
+    fn caps_exponential_retry_delay() {
+        let config = HttpRetryConfig {
+            max_attempts: 3,
+            base_delay_ms: 100,
+            max_delay_ms: 250,
+        };
+
+        assert_eq!(
+            config.delay_for_retry(0),
+            std::time::Duration::from_millis(100)
+        );
+        assert_eq!(
+            config.delay_for_retry(1),
+            std::time::Duration::from_millis(200)
+        );
+        assert_eq!(
+            config.delay_for_retry(2),
+            std::time::Duration::from_millis(250)
+        );
+    }
+}

crates/aether-http/src/lib.rs

@@ -0,0 +1,7 @@
+mod client;
+mod config;
+mod retry;
+
+pub use client::{apply_http_client_config, build_http_client, build_http_client_with_headers};
+pub use config::{HttpClientConfig, HttpRetryConfig};
+pub use retry::jittered_delay_for_retry;

crates/aether-http/src/retry.rs

@@ -0,0 +1,34 @@
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+use crate::HttpRetryConfig;
+
+pub fn jittered_delay_for_retry(config: HttpRetryConfig, retry_index: u32) -> Duration {
+    let base = config.delay_for_retry(retry_index);
+    if base.is_zero() {
+        return base;
+    }
+
+    let nanos = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|duration| duration.subsec_nanos() as u64)
+        .unwrap_or(0);
+    let jitter_ms = nanos % 100;
+    base + Duration::from_millis(jitter_ms)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::jittered_delay_for_retry;
+    use crate::HttpRetryConfig;
+
+    #[test]
+    fn jittered_delay_is_at_least_base_delay() {
+        let config = HttpRetryConfig {
+            max_attempts: 3,
+            base_delay_ms: 200,
+            max_delay_ms: 400,
+        };
+
+        assert!(jittered_delay_for_retry(config, 0) >= std::time::Duration::from_millis(200));
+    }
+}