refactor: 移除 Python upstream 依赖，清理全部 legacy/Python 兼容层

- 移除 upstream_base_url 参数及 AETHER_GATEWAY_UPSTREAM 环境变量，gateway 不再需要指向 Python 宿主
- 删除所有 LEGACY_*/PYTHON_* 常量、路由组、header 定义及 sunset/phaseout 机制
- 将 legacy_gateway_bridge 重命名为 internal_gateway，executor 相关命名统一为 execution_runtime
- dev.sh 新增 Postgres/Redis 预检查，移除 upstream 相关启动参数和提示
- 新增 ai_public 路由处理器
- 全量适配 handler、test、state、control 等模块的命名和接口变更

apps/aether-gateway/src/handlers/admin/provider_ops/architectures.rs

@@ -1,5 +1,14 @@
-use super::*;
-use serde_json::json;
+use crate::gateway::handlers::{
+    admin_provider_ops_architecture_id_from_path, is_admin_provider_ops_architectures_root,
+};
+use crate::gateway::{GatewayError, GatewayPublicRequestContext};
+use axum::{
+    body::Body,
+    http,
+    response::{IntoResponse, Response},
+    Json,
+};
+use serde_json::{json, Value};
 
 static ADMIN_PROVIDER_OPS_ARCHITECTURES_ALL: std::sync::LazyLock<Vec<Value>> =
     std::sync::LazyLock::new(|| {

apps/aether-gateway/src/handlers/admin/provider_ops/providers.rs

@@ -1,4 +1,23 @@
-use super::*;
+use crate::gateway::handlers::{
+    admin_provider_id_for_provider_ops_balance, admin_provider_id_for_provider_ops_checkin,
+    admin_provider_id_for_provider_ops_config, admin_provider_id_for_provider_ops_connect,
+    admin_provider_id_for_provider_ops_disconnect, admin_provider_id_for_provider_ops_status,
+    admin_provider_id_for_provider_ops_verify, admin_provider_ops_action_route_parts,
+    decrypt_catalog_secret_with_fallbacks, encrypt_catalog_secret_with_fallbacks,
+};
+use crate::gateway::{AppState, GatewayError, GatewayPublicRequestContext};
+use aether_data::repository::provider_catalog::{
+    StoredProviderCatalogEndpoint, StoredProviderCatalogProvider,
+};
+use axum::{
+    body::{Body, Bytes},
+    http,
+    response::{IntoResponse, Response},
+    Json,
+};
+use serde::Deserialize;
+use std::collections::BTreeMap;
+use std::time::{SystemTime, UNIX_EPOCH};
 
 #[path = "providers/actions.rs"]
 mod actions;

apps/aether-gateway/src/handlers/admin/provider_ops/providers/actions.rs

@@ -1,4 +1,14 @@
-use super::*;
+use super::{
+    admin_provider_ops_config_object, admin_provider_ops_connector_object,
+    admin_provider_ops_decrypted_credentials, admin_provider_ops_uses_python_verify_fallback,
+    admin_provider_ops_value_as_f64, admin_provider_ops_verify_headers,
+    resolve_admin_provider_ops_base_url, AdminProviderOpsCheckinOutcome,
+    ADMIN_PROVIDER_OPS_ACTION_RUST_ONLY_MESSAGE,
+};
+use crate::gateway::AppState;
+use aether_data::repository::provider_catalog::{
+    StoredProviderCatalogEndpoint, StoredProviderCatalogProvider,
+};
 use serde_json::json;
 
 pub(super) fn admin_provider_ops_is_valid_action_type(action_type: &str) -> bool {

apps/aether-gateway/src/handlers/admin/provider_ops/providers/config.rs

@@ -1,4 +1,11 @@
-use super::*;
+use super::{AdminProviderOpsSaveConfigRequest, ADMIN_PROVIDER_OPS_SENSITIVE_FIELDS};
+use crate::gateway::handlers::{
+    decrypt_catalog_secret_with_fallbacks, encrypt_catalog_secret_with_fallbacks,
+};
+use crate::gateway::AppState;
+use aether_data::repository::provider_catalog::{
+    StoredProviderCatalogEndpoint, StoredProviderCatalogProvider,
+};
 use serde_json::json;
 
 pub(super) fn admin_provider_ops_config_object(

apps/aether-gateway/src/handlers/admin/provider_ops/providers/routes.rs

@@ -1,10 +1,34 @@
-use super::*;
+use super::{
+    admin_provider_ops_config_object, admin_provider_ops_connector_object,
+    admin_provider_ops_decrypted_credentials, admin_provider_ops_is_valid_action_type,
+    admin_provider_ops_local_action_response, admin_provider_ops_local_verify_response,
+    admin_provider_ops_merge_credentials, admin_provider_ops_normalized_verify_architecture_id,
+    admin_provider_ops_verify_failure, build_admin_provider_ops_config_payload,
+    build_admin_provider_ops_saved_config_value, build_admin_provider_ops_status_payload,
+    resolve_admin_provider_ops_base_url, AdminProviderOpsConnectRequest,
+    AdminProviderOpsExecuteActionRequest, AdminProviderOpsSaveConfigRequest,
+    ADMIN_PROVIDER_OPS_CONNECT_RUST_ONLY_MESSAGE,
+};
+use crate::gateway::handlers::{
+    admin_provider_id_for_provider_ops_balance, admin_provider_id_for_provider_ops_checkin,
+    admin_provider_id_for_provider_ops_config, admin_provider_id_for_provider_ops_connect,
+    admin_provider_id_for_provider_ops_disconnect, admin_provider_id_for_provider_ops_status,
+    admin_provider_id_for_provider_ops_verify, admin_provider_ops_action_route_parts,
+};
+use crate::gateway::{AppState, GatewayError, GatewayPublicRequestContext};
+use axum::{
+    body::{Body, Bytes},
+    http,
+    response::{IntoResponse, Response},
+    Json,
+};
 use serde_json::json;
+use std::time::{SystemTime, UNIX_EPOCH};
 
 pub(crate) async fn maybe_build_local_admin_provider_ops_providers_response(
     state: &AppState,
     request_context: &GatewayPublicRequestContext,
-    request_body: Option<&axum::body::Bytes>,
+    request_body: Option<&Bytes>,
 ) -> Result<Option<Response<Body>>, GatewayError> {
     let Some(decision) = request_context.control_decision.as_ref() else {
         return Ok(None);

apps/aether-gateway/src/handlers/admin/provider_ops/providers/verify.rs

@@ -1,4 +1,7 @@
-use super::*;
+use super::ADMIN_PROVIDER_OPS_VERIFY_RUST_ONLY_MESSAGE;
+use crate::gateway::AppState;
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use regex::Regex;
 use serde_json::json;
 
 pub(super) fn admin_provider_ops_normalized_verify_architecture_id(architecture_id: &str) -> &str {