feat: 引入 aether-runtime/cache/data/http/testkit 基础 crate，完善并发门控与审计系统

新增 crate：
- aether-runtime: 服务运行时基础设施（并发门控、分布式并发、指标、队列、优雅关闭、tracing）
- aether-cache: 通用 TTL 缓存与命名空间抽象
- aether-data: 数据访问层（PostgreSQL/Redis 后端、repository 模式）
- aether-http: HTTP 客户端封装（重试、配置）
- aether-testkit: 集成测试工具集（gateway/executor/hub/proxy fixture、等待、负载测试）

gateway 扩展：
- 引入 audit 模块（shadow 执行审计、决策链路追踪、请求审计 bundle）
- 引入 cache 模块（AuthContext 缓存、direct-plan bypass 缓存）
- 引入 data 模块（auth/candidates/config/usage/video_tasks 数据访问）
- 集成 ConcurrencyGate/DistributedConcurrencyGate 请求门控
- 新增本地 auth 拒绝、过载响应构建器
- 补充 control/auth_cache/video/concurrency 集成测试

aether-proxy 扩展：
- AppState 集成 stream_gate / distributed_stream_gate 并发门控
- 新增 ProxyAdmissionError 及准入拒绝流程
- stream_handler 补充门控饱和/不可用场景测试
- 配置与注册客户端逻辑完善

aether-hub 扩展：
- main.rs 引入运行时初始化、指标端点、健康检查
- local_relay 重构为 lib.rs 暴露公共接口

crates/aether-http/src/config.rs

@@ -0,0 +1,109 @@
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize, PartialEq, Eq)]
+pub struct HttpClientConfig {
+    pub connect_timeout_ms: Option<u64>,
+    pub request_timeout_ms: Option<u64>,
+    pub pool_idle_timeout_ms: Option<u64>,
+    pub pool_max_idle_per_host: Option<usize>,
+    pub tcp_keepalive_ms: Option<u64>,
+    pub tcp_nodelay: bool,
+    pub http2_adaptive_window: bool,
+    pub use_rustls_tls: bool,
+    pub user_agent: Option<String>,
+}
+
+impl Default for HttpClientConfig {
+    fn default() -> Self {
+        Self {
+            connect_timeout_ms: None,
+            request_timeout_ms: None,
+            pool_idle_timeout_ms: None,
+            pool_max_idle_per_host: None,
+            tcp_keepalive_ms: None,
+            tcp_nodelay: true,
+            http2_adaptive_window: false,
+            use_rustls_tls: true,
+            user_agent: None,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, serde::Serialize, serde::Deserialize, PartialEq, Eq)]
+pub struct HttpRetryConfig {
+    pub max_attempts: u32,
+    pub base_delay_ms: u64,
+    pub max_delay_ms: u64,
+}
+
+impl Default for HttpRetryConfig {
+    fn default() -> Self {
+        Self {
+            max_attempts: 3,
+            base_delay_ms: 200,
+            max_delay_ms: 2_000,
+        }
+    }
+}
+
+impl HttpRetryConfig {
+    pub fn normalized(self) -> Self {
+        let max_attempts = self.max_attempts.max(1);
+        let base_delay_ms = self.base_delay_ms.max(1);
+        let max_delay_ms = self.max_delay_ms.max(base_delay_ms);
+        Self {
+            max_attempts,
+            base_delay_ms,
+            max_delay_ms,
+        }
+    }
+
+    pub fn delay_for_retry(self, retry_index: u32) -> std::time::Duration {
+        let config = self.normalized();
+        let factor = 2_u64.saturating_pow(retry_index.min(20));
+        let delay_ms = config
+            .base_delay_ms
+            .saturating_mul(factor)
+            .min(config.max_delay_ms);
+        std::time::Duration::from_millis(delay_ms)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::HttpRetryConfig;
+
+    #[test]
+    fn normalizes_retry_bounds() {
+        let config = HttpRetryConfig {
+            max_attempts: 0,
+            base_delay_ms: 0,
+            max_delay_ms: 5,
+        }
+        .normalized();
+
+        assert_eq!(config.max_attempts, 1);
+        assert_eq!(config.base_delay_ms, 1);
+        assert_eq!(config.max_delay_ms, 5);
+    }
+
+    #[test]
+    fn caps_exponential_retry_delay() {
+        let config = HttpRetryConfig {
+            max_attempts: 3,
+            base_delay_ms: 100,
+            max_delay_ms: 250,
+        };
+
+        assert_eq!(
+            config.delay_for_retry(0),
+            std::time::Duration::from_millis(100)
+        );
+        assert_eq!(
+            config.delay_for_retry(1),
+            std::time::Duration::from_millis(200)
+        );
+        assert_eq!(
+            config.delay_for_retry(2),
+            std::time::Duration::from_millis(250)
+        );
+    }
+}