refactor: 移除 Python upstream 依赖，清理全部 legacy/Python 兼容层

- 移除 upstream_base_url 参数及 AETHER_GATEWAY_UPSTREAM 环境变量，gateway 不再需要指向 Python 宿主
- 删除所有 LEGACY_*/PYTHON_* 常量、路由组、header 定义及 sunset/phaseout 机制
- 将 legacy_gateway_bridge 重命名为 internal_gateway，executor 相关命名统一为 execution_runtime
- dev.sh 新增 Postgres/Redis 预检查，移除 upstream 相关启动参数和提示
- 新增 ai_public 路由处理器
- 全量适配 handler、test、state、control 等模块的命名和接口变更

apps/aether-gateway/src/control/tests/admin_adaptive.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_adaptive_keys_list_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/admin_api_keys.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_api_keys_list_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/admin_billing.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_billing_presets_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/admin_core.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_endpoint_health_api_formats_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/admin_endpoints.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_endpoint_health_summary_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/admin_monitoring.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_monitoring_audit_logs_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/admin_oauth.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_provider_oauth_start_key_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/admin_payments.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_payments_list_orders_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/admin_pool.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_pool_overview_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/admin_provider_ops.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_provider_ops_architectures_list_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/admin_provider_query.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_provider_query_models_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/admin_provider_strategy.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_provider_strategy_list_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/admin_providers_models.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_create_provider_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/admin_proxy_nodes.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_proxy_nodes_list_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/admin_security.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_security_blacklist_add_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/admin_stats.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_stats_provider_quota_usage_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/admin_usage.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_usage_stats_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/admin_users.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_users_list_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/admin_video_tasks.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_video_tasks_list_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/admin_wallets.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_admin_wallets_list_as_admin_proxy_route() {

apps/aether-gateway/src/control/tests/ai.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_claude_count_tokens_as_non_execution_runtime_public_route() {

apps/aether-gateway/src/control/tests/internal.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_internal_tunnel_heartbeat_as_internal_proxy_route() {
@@ -29,7 +31,7 @@ fn classifies_internal_gateway_resolve_as_internal_proxy_route() {
         classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
 
     assert_eq!(decision.route_class.as_deref(), Some("internal_proxy"));
-    assert_eq!(decision.route_family.as_deref(), Some("gateway_legacy"));
+    assert_eq!(decision.route_family.as_deref(), Some("internal_gateway"));
     assert_eq!(decision.route_kind.as_deref(), Some("resolve"));
     assert_eq!(decision.auth_endpoint_signature.as_deref(), Some(""));
     assert!(!decision.is_execution_runtime_candidate());

apps/aether-gateway/src/control/tests/mod.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, GatewayPublicRequestContext};
 
 fn headers(items: &[(&str, &str)]) -> http::HeaderMap {
     let mut headers = http::HeaderMap::new();

apps/aether-gateway/src/control/tests/public_support.rs

@@ -1,4 +1,6 @@
-use super::*;
+use http::Uri;
+
+use super::{classify_control_route, headers};
 
 #[test]
 fn classifies_models_list_as_public_support_route() {
@@ -174,14 +176,14 @@ fn classifies_public_announcement_detail_as_public_support_route() {
 }
 
 #[test]
-fn classifies_dashboard_stats_as_public_support_legacy_route() {
+fn classifies_dashboard_stats_as_public_support_route() {
     let headers = headers(&[]);
     let uri: Uri = "/api/dashboard/stats".parse().expect("uri should parse");
     let decision =
         classify_control_route(&http::Method::GET, &uri, &headers).expect("route should classify");
 
     assert_eq!(decision.route_class.as_deref(), Some("public_support"));
-    assert_eq!(decision.route_family.as_deref(), Some("dashboard_legacy"));
+    assert_eq!(decision.route_family.as_deref(), Some("dashboard"));
     assert_eq!(decision.route_kind.as_deref(), Some("stats"));
     assert_eq!(
         decision.auth_endpoint_signature.as_deref(),
@@ -191,7 +193,7 @@ fn classifies_dashboard_stats_as_public_support_legacy_route() {
 }
 
 #[test]
-fn classifies_user_monitoring_audit_logs_as_public_support_legacy_route() {
+fn classifies_user_monitoring_audit_logs_as_public_support_route() {
     let headers = headers(&[]);
     let uri: Uri = "/api/monitoring/my-audit-logs"
         .parse()
@@ -200,10 +202,7 @@ fn classifies_user_monitoring_audit_logs_as_public_support_legacy_route() {
         classify_control_route(&http::Method::GET, &uri, &headers).expect("route should classify");
 
     assert_eq!(decision.route_class.as_deref(), Some("public_support"));
-    assert_eq!(
-        decision.route_family.as_deref(),
-        Some("monitoring_user_legacy")
-    );
+    assert_eq!(decision.route_family.as_deref(), Some("monitoring_user"));
     assert_eq!(decision.route_kind.as_deref(), Some("audit_logs"));
     assert_eq!(
         decision.auth_endpoint_signature.as_deref(),
@@ -213,7 +212,7 @@ fn classifies_user_monitoring_audit_logs_as_public_support_legacy_route() {
 }
 
 #[test]
-fn classifies_announcement_unread_count_as_public_support_legacy_route() {
+fn classifies_announcement_unread_count_as_public_support_route() {
     let headers = headers(&[]);
     let uri: Uri = "/api/announcements/users/me/unread-count"
         .parse()
@@ -222,10 +221,7 @@ fn classifies_announcement_unread_count_as_public_support_legacy_route() {
         classify_control_route(&http::Method::GET, &uri, &headers).expect("route should classify");
 
     assert_eq!(decision.route_class.as_deref(), Some("public_support"));
-    assert_eq!(
-        decision.route_family.as_deref(),
-        Some("announcement_user_legacy")
-    );
+    assert_eq!(decision.route_family.as_deref(), Some("announcement_user"));
     assert_eq!(decision.route_kind.as_deref(), Some("unread_count"));
     assert_eq!(
         decision.auth_endpoint_signature.as_deref(),
@@ -235,7 +231,7 @@ fn classifies_announcement_unread_count_as_public_support_legacy_route() {
 }
 
 #[test]
-fn classifies_announcement_read_status_as_public_support_legacy_route() {
+fn classifies_announcement_read_status_as_public_support_route() {
     let headers = headers(&[]);
     let uri: Uri = "/api/announcements/announcement-1/read-status"
         .parse()
@@ -244,10 +240,7 @@ fn classifies_announcement_read_status_as_public_support_legacy_route() {
         .expect("route should classify");
 
     assert_eq!(decision.route_class.as_deref(), Some("public_support"));
-    assert_eq!(
-        decision.route_family.as_deref(),
-        Some("announcement_user_legacy")
-    );
+    assert_eq!(decision.route_family.as_deref(), Some("announcement_user"));
     assert_eq!(decision.route_kind.as_deref(), Some("read_status"));
     assert_eq!(
         decision.auth_endpoint_signature.as_deref(),
@@ -257,7 +250,7 @@ fn classifies_announcement_read_status_as_public_support_legacy_route() {
 }
 
 #[test]
-fn classifies_announcement_read_all_as_public_support_legacy_route() {
+fn classifies_announcement_read_all_as_public_support_route() {
     let headers = headers(&[]);
     let uri: Uri = "/api/announcements/read-all"
         .parse()
@@ -266,10 +259,7 @@ fn classifies_announcement_read_all_as_public_support_legacy_route() {
         classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
 
     assert_eq!(decision.route_class.as_deref(), Some("public_support"));
-    assert_eq!(
-        decision.route_family.as_deref(),
-        Some("announcement_user_legacy")
-    );
+    assert_eq!(decision.route_family.as_deref(), Some("announcement_user"));
     assert_eq!(decision.route_kind.as_deref(), Some("read_all"));
     assert_eq!(
         decision.auth_endpoint_signature.as_deref(),
@@ -279,7 +269,7 @@ fn classifies_announcement_read_all_as_public_support_legacy_route() {
 }
 
 #[test]
-fn classifies_wallet_legacy_routes_as_public_support_legacy_route() {
+fn classifies_wallet_routes_as_public_support_route() {
     let headers = headers(&[]);
     for (method, uri, route_kind) in [
         (http::Method::GET, "/api/wallet/balance", "balance"),
@@ -322,7 +312,7 @@ fn classifies_wallet_legacy_routes_as_public_support_legacy_route() {
             classify_control_route(&method, &uri, &headers).expect("route should classify");
 
         assert_eq!(decision.route_class.as_deref(), Some("public_support"));
-        assert_eq!(decision.route_family.as_deref(), Some("wallet_legacy"));
+        assert_eq!(decision.route_family.as_deref(), Some("wallet"));
         assert_eq!(decision.route_kind.as_deref(), Some(route_kind));
         assert_eq!(
             decision.auth_endpoint_signature.as_deref(),
@@ -333,7 +323,7 @@ fn classifies_wallet_legacy_routes_as_public_support_legacy_route() {
 }
 
 #[test]
-fn classifies_users_me_legacy_routes_as_public_support_legacy_route() {
+fn classifies_users_me_routes_as_public_support_route() {
     let headers = headers(&[]);
     for (method, uri, route_kind) in [
         (http::Method::GET, "/api/users/me", "detail"),
@@ -436,7 +426,7 @@ fn classifies_users_me_legacy_routes_as_public_support_legacy_route() {
             classify_control_route(&method, &uri, &headers).expect("route should classify");
 
         assert_eq!(decision.route_class.as_deref(), Some("public_support"));
-        assert_eq!(decision.route_family.as_deref(), Some("users_me_legacy"));
+        assert_eq!(decision.route_family.as_deref(), Some("users_me"));
         assert_eq!(decision.route_kind.as_deref(), Some(route_kind));
         assert_eq!(
             decision.auth_endpoint_signature.as_deref(),
@@ -447,7 +437,7 @@ fn classifies_users_me_legacy_routes_as_public_support_legacy_route() {
 }
 
 #[test]
-fn classifies_payment_callback_as_public_support_legacy_route() {
+fn classifies_payment_callback_as_public_support_route() {
     let headers = headers(&[]);
     let uri: Uri = "/api/payment/callback/alipay"
         .parse()
@@ -456,10 +446,7 @@ fn classifies_payment_callback_as_public_support_legacy_route() {
         classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
 
     assert_eq!(decision.route_class.as_deref(), Some("public_support"));
-    assert_eq!(
-        decision.route_family.as_deref(),
-        Some("payment_callback_legacy")
-    );
+    assert_eq!(decision.route_family.as_deref(), Some("payment_callback"));
     assert_eq!(decision.route_kind.as_deref(), Some("callback"));
     assert_eq!(
         decision.auth_endpoint_signature.as_deref(),
@@ -620,7 +607,7 @@ fn classifies_auth_settings_as_public_support_route() {
 }
 
 #[test]
-fn classifies_auth_legacy_routes_as_public_support_route() {
+fn classifies_auth_routes_as_public_support_route() {
     for (method, path, route_kind) in [
         (http::Method::POST, "/api/auth/login", "login"),
         (http::Method::POST, "/api/auth/refresh", "refresh"),
@@ -645,7 +632,7 @@ fn classifies_auth_legacy_routes_as_public_support_route() {
             classify_control_route(&method, &uri, &headers).expect("route should classify");
 
         assert_eq!(decision.route_class.as_deref(), Some("public_support"));
-        assert_eq!(decision.route_family.as_deref(), Some("auth_legacy"));
+        assert_eq!(decision.route_family.as_deref(), Some("auth"));
         assert_eq!(decision.route_kind.as_deref(), Some(route_kind));
         assert_eq!(
             decision.auth_endpoint_signature.as_deref(),
@@ -656,71 +643,45 @@ fn classifies_auth_legacy_routes_as_public_support_route() {
 }
 
 #[test]
-fn classifies_oauth_public_providers_as_public_support_route() {
+fn does_not_classify_oauth_public_providers_route() {
     let headers = headers(&[]);
     let uri: Uri = "/api/oauth/providers".parse().expect("uri should parse");
-    let decision =
-        classify_control_route(&http::Method::GET, &uri, &headers).expect("route should classify");
+    let decision = classify_control_route(&http::Method::GET, &uri, &headers);
 
-    assert_eq!(decision.route_class.as_deref(), Some("public_support"));
-    assert_eq!(
-        decision.route_family.as_deref(),
-        Some("oauth_public_legacy")
-    );
-    assert_eq!(decision.route_kind.as_deref(), Some("providers"));
-    assert_eq!(decision.auth_endpoint_signature.as_deref(), Some(""));
-    assert!(!decision.is_execution_runtime_candidate());
+    assert!(decision.is_none());
 }
 
 #[test]
-fn classifies_oauth_public_authorize_as_public_support_route() {
+fn does_not_classify_oauth_public_authorize_route() {
     let headers = headers(&[]);
     let uri: Uri = "/api/oauth/linuxdo/authorize?client_device_id=device-1"
         .parse()
         .expect("uri should parse");
-    let decision =
-        classify_control_route(&http::Method::GET, &uri, &headers).expect("route should classify");
+    let decision = classify_control_route(&http::Method::GET, &uri, &headers);
 
-    assert_eq!(decision.route_class.as_deref(), Some("public_support"));
-    assert_eq!(
-        decision.route_family.as_deref(),
-        Some("oauth_public_legacy")
-    );
-    assert_eq!(decision.route_kind.as_deref(), Some("authorize"));
-    assert_eq!(decision.auth_endpoint_signature.as_deref(), Some(""));
-    assert!(!decision.is_execution_runtime_candidate());
+    assert!(decision.is_none());
 }
 
 #[test]
-fn classifies_oauth_user_bindable_providers_as_public_support_route() {
+fn does_not_classify_oauth_user_bindable_providers_route() {
     let headers = headers(&[]);
     let uri: Uri = "/api/user/oauth/bindable-providers"
         .parse()
         .expect("uri should parse");
-    let decision =
-        classify_control_route(&http::Method::GET, &uri, &headers).expect("route should classify");
+    let decision = classify_control_route(&http::Method::GET, &uri, &headers);
 
-    assert_eq!(decision.route_class.as_deref(), Some("public_support"));
-    assert_eq!(decision.route_family.as_deref(), Some("oauth_user_legacy"));
-    assert_eq!(decision.route_kind.as_deref(), Some("bindable_providers"));
-    assert_eq!(decision.auth_endpoint_signature.as_deref(), Some(""));
-    assert!(!decision.is_execution_runtime_candidate());
+    assert!(decision.is_none());
 }
 
 #[test]
-fn classifies_oauth_user_bind_token_as_public_support_route() {
+fn does_not_classify_oauth_user_bind_token_route() {
     let headers = headers(&[]);
     let uri: Uri = "/api/user/oauth/linuxdo/bind-token"
         .parse()
         .expect("uri should parse");
-    let decision =
-        classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
+    let decision = classify_control_route(&http::Method::POST, &uri, &headers);
 
-    assert_eq!(decision.route_class.as_deref(), Some("public_support"));
-    assert_eq!(decision.route_family.as_deref(), Some("oauth_user_legacy"));
-    assert_eq!(decision.route_kind.as_deref(), Some("bind_token"));
-    assert_eq!(decision.auth_endpoint_signature.as_deref(), Some(""));
-    assert!(!decision.is_execution_runtime_candidate());
+    assert!(decision.is_none());
 }
 
 #[test]