feat: 引入 aether-runtime/cache/data/http/testkit 基础 crate，完善并发门控与审计系统

新增 crate：
- aether-runtime: 服务运行时基础设施（并发门控、分布式并发、指标、队列、优雅关闭、tracing）
- aether-cache: 通用 TTL 缓存与命名空间抽象
- aether-data: 数据访问层（PostgreSQL/Redis 后端、repository 模式）
- aether-http: HTTP 客户端封装（重试、配置）
- aether-testkit: 集成测试工具集（gateway/executor/hub/proxy fixture、等待、负载测试）

gateway 扩展：
- 引入 audit 模块（shadow 执行审计、决策链路追踪、请求审计 bundle）
- 引入 cache 模块（AuthContext 缓存、direct-plan bypass 缓存）
- 引入 data 模块（auth/candidates/config/usage/video_tasks 数据访问）
- 集成 ConcurrencyGate/DistributedConcurrencyGate 请求门控
- 新增本地 auth 拒绝、过载响应构建器
- 补充 control/auth_cache/video/concurrency 集成测试

aether-proxy 扩展：
- AppState 集成 stream_gate / distributed_stream_gate 并发门控
- 新增 ProxyAdmissionError 及准入拒绝流程
- stream_handler 补充门控饱和/不可用场景测试
- 配置与注册客户端逻辑完善

aether-hub 扩展：
- main.rs 引入运行时初始化、指标端点、健康检查
- local_relay 重构为 lib.rs 暴露公共接口

crates/aether-testkit/src/postgres.rs

@@ -0,0 +1,148 @@
+use std::path::PathBuf;
+use std::process::{Child, Command, Stdio};
+
+use sqlx::{Connection, PgConnection};
+
+use crate::wait_until;
+
+#[derive(Debug)]
+pub struct ManagedPostgresServer {
+    child: Option<Child>,
+    postgres_bin: String,
+    port: u16,
+    workdir: PathBuf,
+    data_dir: PathBuf,
+    database_url: String,
+}
+
+impl ManagedPostgresServer {
+    pub async fn start() -> Result<Self, Box<dyn std::error::Error>> {
+        let port = reserve_local_port()?;
+        let workdir = std::env::temp_dir().join(format!(
+            "aether-postgres-baseline-{}-{}",
+            std::process::id(),
+            port
+        ));
+        let data_dir = workdir.join("data");
+        std::fs::create_dir_all(&workdir)?;
+
+        let initdb_bin = std::env::var("AETHER_INITDB_BIN")
+            .ok()
+            .filter(|value| !value.trim().is_empty())
+            .unwrap_or_else(|| "initdb".to_string());
+        let postgres_bin = std::env::var("AETHER_POSTGRES_BIN")
+            .ok()
+            .filter(|value| !value.trim().is_empty())
+            .unwrap_or_else(|| "postgres".to_string());
+
+        let init_output = Command::new(&initdb_bin)
+            .arg("-D")
+            .arg(&data_dir)
+            .arg("-U")
+            .arg("aether")
+            .arg("--auth=trust")
+            .arg("--encoding=UTF8")
+            .arg("--no-instructions")
+            .output()?;
+        if !init_output.status.success() {
+            return Err(std::io::Error::other(format!(
+                "initdb failed: {}",
+                String::from_utf8_lossy(&init_output.stderr)
+            ))
+            .into());
+        }
+
+        let database_url = format!("postgres://aether@127.0.0.1:{port}/postgres");
+        let mut server = Self {
+            child: None,
+            postgres_bin,
+            port,
+            workdir,
+            data_dir,
+            database_url,
+        };
+        server.restart().await?;
+        Ok(server)
+    }
+
+    pub fn database_url(&self) -> &str {
+        &self.database_url
+    }
+
+    pub fn port(&self) -> u16 {
+        self.port
+    }
+
+    pub fn stop(&mut self) -> Result<(), std::io::Error> {
+        if let Some(mut child) = self.child.take() {
+            let _ = child.kill();
+            let _ = child.wait();
+        }
+        Ok(())
+    }
+
+    pub async fn restart(&mut self) -> Result<(), Box<dyn std::error::Error>> {
+        self.stop()?;
+        let log_path = self.workdir.join("postgres.log");
+        let stdout = std::fs::File::create(&log_path)?;
+        let stderr = stdout.try_clone()?;
+        let child = Command::new(&self.postgres_bin)
+            .arg("-D")
+            .arg(&self.data_dir)
+            .arg("-h")
+            .arg("127.0.0.1")
+            .arg("-p")
+            .arg(self.port.to_string())
+            .arg("-F")
+            .arg("-c")
+            .arg("fsync=off")
+            .arg("-c")
+            .arg("synchronous_commit=off")
+            .arg("-c")
+            .arg("full_page_writes=off")
+            .stdout(Stdio::from(stdout))
+            .stderr(Stdio::from(stderr))
+            .spawn()?;
+        self.child = Some(child);
+
+        let database_url = self.database_url.clone();
+        let ready = wait_until(
+            std::time::Duration::from_secs(10),
+            std::time::Duration::from_millis(50),
+            || {
+                let database_url = database_url.clone();
+                async move {
+                    match PgConnection::connect(&database_url).await {
+                        Ok(connection) => connection.close().await.is_ok(),
+                        Err(_) => false,
+                    }
+                }
+            },
+        )
+        .await;
+        if !ready {
+            self.stop()?;
+            let logs = std::fs::read_to_string(&log_path).unwrap_or_default();
+            return Err(std::io::Error::new(
+                std::io::ErrorKind::TimedOut,
+                format!("timed out waiting for local postgres; logs:\n{logs}"),
+            )
+            .into());
+        }
+        Ok(())
+    }
+}
+
+impl Drop for ManagedPostgresServer {
+    fn drop(&mut self) {
+        let _ = self.stop();
+        let _ = std::fs::remove_dir_all(&self.workdir);
+    }
+}
+
+fn reserve_local_port() -> Result<u16, std::io::Error> {
+    let listener = std::net::TcpListener::bind("127.0.0.1:0")?;
+    let port = listener.local_addr()?.port();
+    drop(listener);
+    Ok(port)
+}