feat: 引入 aether-runtime/cache/data/http/testkit 基础 crate，完善并发门控与审计系统

新增 crate：
- aether-runtime: 服务运行时基础设施（并发门控、分布式并发、指标、队列、优雅关闭、tracing）
- aether-cache: 通用 TTL 缓存与命名空间抽象
- aether-data: 数据访问层（PostgreSQL/Redis 后端、repository 模式）
- aether-http: HTTP 客户端封装（重试、配置）
- aether-testkit: 集成测试工具集（gateway/executor/hub/proxy fixture、等待、负载测试）

gateway 扩展：
- 引入 audit 模块（shadow 执行审计、决策链路追踪、请求审计 bundle）
- 引入 cache 模块（AuthContext 缓存、direct-plan bypass 缓存）
- 引入 data 模块（auth/candidates/config/usage/video_tasks 数据访问）
- 集成 ConcurrencyGate/DistributedConcurrencyGate 请求门控
- 新增本地 auth 拒绝、过载响应构建器
- 补充 control/auth_cache/video/concurrency 集成测试

aether-proxy 扩展：
- AppState 集成 stream_gate / distributed_stream_gate 并发门控
- 新增 ProxyAdmissionError 及准入拒绝流程
- stream_handler 补充门控饱和/不可用场景测试
- 配置与注册客户端逻辑完善

aether-hub 扩展：
- main.rs 引入运行时初始化、指标端点、健康检查
- local_relay 重构为 lib.rs 暴露公共接口

crates/aether-http/src/client.rs

@@ -0,0 +1,75 @@
+use std::time::Duration;
+
+use reqwest::header::HeaderMap;
+
+use crate::HttpClientConfig;
+
+pub fn apply_http_client_config(
+    mut builder: reqwest::ClientBuilder,
+    config: &HttpClientConfig,
+) -> reqwest::ClientBuilder {
+    if config.use_rustls_tls {
+        builder = builder.use_rustls_tls();
+    }
+    if let Some(timeout_ms) = config.connect_timeout_ms {
+        builder = builder.connect_timeout(Duration::from_millis(timeout_ms));
+    }
+    if let Some(timeout_ms) = config.request_timeout_ms {
+        builder = builder.timeout(Duration::from_millis(timeout_ms));
+    }
+    if let Some(timeout_ms) = config.pool_idle_timeout_ms {
+        builder = builder.pool_idle_timeout(Duration::from_millis(timeout_ms));
+    }
+    if let Some(max_idle) = config.pool_max_idle_per_host {
+        builder = builder.pool_max_idle_per_host(max_idle);
+    }
+
+    builder = builder.tcp_keepalive(config.tcp_keepalive_ms.map(Duration::from_millis));
+    builder = builder.tcp_nodelay(config.tcp_nodelay);
+
+    if config.http2_adaptive_window {
+        builder = builder.http2_adaptive_window(true);
+    }
+    if let Some(user_agent) = &config.user_agent {
+        builder = builder.user_agent(user_agent.clone());
+    }
+
+    builder
+}
+
+pub fn build_http_client(config: &HttpClientConfig) -> Result<reqwest::Client, reqwest::Error> {
+    build_http_client_with_headers(config, HeaderMap::new())
+}
+
+pub fn build_http_client_with_headers(
+    config: &HttpClientConfig,
+    default_headers: HeaderMap,
+) -> Result<reqwest::Client, reqwest::Error> {
+    let mut builder = apply_http_client_config(reqwest::Client::builder(), config);
+    if !default_headers.is_empty() {
+        builder = builder.default_headers(default_headers);
+    }
+    builder.build()
+}
+
+#[cfg(test)]
+mod tests {
+    use reqwest::header::{HeaderMap, HeaderValue};
+
+    use super::build_http_client_with_headers;
+    use crate::HttpClientConfig;
+
+    #[test]
+    fn builds_client_with_default_headers() {
+        let mut headers = HeaderMap::new();
+        headers.insert("x-test", HeaderValue::from_static("ok"));
+        let config = HttpClientConfig {
+            connect_timeout_ms: Some(100),
+            request_timeout_ms: Some(500),
+            ..HttpClientConfig::default()
+        };
+
+        let client = build_http_client_with_headers(&config, headers);
+        assert!(client.is_ok());
+    }
+}