refactor: 移除 Python upstream 依赖，清理全部 legacy/Python 兼容层

- 移除 upstream_base_url 参数及 AETHER_GATEWAY_UPSTREAM 环境变量，gateway 不再需要指向 Python 宿主
- 删除所有 LEGACY_*/PYTHON_* 常量、路由组、header 定义及 sunset/phaseout 机制
- 将 legacy_gateway_bridge 重命名为 internal_gateway，executor 相关命名统一为 execution_runtime
- dev.sh 新增 Postgres/Redis 预检查，移除 upstream 相关启动参数和提示
- 新增 ai_public 路由处理器
- 全量适配 handler、test、state、control 等模块的命名和接口变更

apps/aether-gateway/src/handlers/admin/users/api_keys.rs

@@ -1,4 +1,20 @@
-use super::*;
+use super::{
+    build_admin_users_bad_request_response, build_admin_users_data_unavailable_response,
+    build_admin_users_read_only_response, AdminCreateUserApiKeyRequest,
+    AdminToggleUserApiKeyLockRequest, AdminUpdateUserApiKeyRequest,
+};
+use crate::gateway::handlers::{
+    decrypt_catalog_secret_with_fallbacks, encrypt_catalog_secret_with_fallbacks,
+    query_param_optional_bool,
+};
+use crate::gateway::{AppState, GatewayError, GatewayPublicRequestContext};
+use axum::{
+    body::Body,
+    http,
+    response::{IntoResponse, Response},
+    Json,
+};
+use serde_json::json;
 
 fn admin_user_api_key_full_key_parts(request_path: &str) -> Option<(String, String)> {
     let raw = request_path.strip_prefix("/api/admin/users/")?;
@@ -324,7 +340,7 @@ pub(super) async fn build_admin_create_user_api_key_response(
         })
         .await?
     else {
-        return Ok(build_admin_users_maintenance_response());
+        return Ok(build_admin_users_data_unavailable_response());
     };
 
     let created = if allowed_providers.is_some() {

apps/aether-gateway/src/handlers/admin/users/lifecycle.rs

@@ -1,4 +1,20 @@
-use super::*;
+use super::{
+    admin_default_user_initial_gift, build_admin_users_bad_request_response,
+    build_admin_users_data_unavailable_response, build_admin_users_read_only_response,
+    format_optional_datetime_iso8601, normalize_admin_optional_user_email,
+    normalize_admin_user_api_formats, normalize_admin_user_role, normalize_admin_user_string_list,
+    normalize_admin_username, validate_admin_user_password, AdminCreateUserRequest,
+    AdminUpdateUserFieldPresence, AdminUpdateUserRequest,
+};
+use crate::gateway::handlers::{query_param_optional_bool, query_param_value};
+use crate::gateway::{AppState, GatewayError, GatewayPublicRequestContext};
+use axum::{
+    body::Body,
+    http,
+    response::{IntoResponse, Response},
+    Json,
+};
+use serde_json::json;
 
 async fn admin_user_password_policy(state: &AppState) -> Result<String, GatewayError> {
     let config = state
@@ -643,7 +659,7 @@ pub(super) async fn build_admin_update_user_response(
                         .await?
                         .is_none()
                     {
-                        return Ok(build_admin_users_maintenance_response());
+                        return Ok(build_admin_users_data_unavailable_response());
                     }
                 }
             }
@@ -653,7 +669,7 @@ pub(super) async fn build_admin_update_user_response(
                     .await?
                     .is_none()
                 {
-                    return Ok(build_admin_users_maintenance_response());
+                    return Ok(build_admin_users_data_unavailable_response());
                 }
             }
         }

apps/aether-gateway/src/handlers/admin/users/routes.rs

@@ -1,4 +1,15 @@
-use super::*;
+use super::{
+    build_admin_create_user_api_key_response, build_admin_create_user_response,
+    build_admin_delete_user_api_key_response, build_admin_delete_user_response,
+    build_admin_delete_user_session_response, build_admin_delete_user_sessions_response,
+    build_admin_get_user_response, build_admin_list_user_api_keys_response,
+    build_admin_list_user_sessions_response, build_admin_list_users_response,
+    build_admin_reveal_user_api_key_response, build_admin_toggle_user_api_key_lock_response,
+    build_admin_update_user_api_key_response, build_admin_update_user_response,
+    build_admin_users_data_unavailable_response,
+};
+use crate::gateway::{AppState, GatewayError, GatewayPublicRequestContext};
+use axum::{body::Body, http, response::Response};
 
 fn is_admin_users_route(request_context: &GatewayPublicRequestContext) -> bool {
     let path = request_context.request_path.as_str();
@@ -110,7 +121,7 @@ pub(super) async fn maybe_build_local_admin_users_routes_response(
             if !is_admin_users_route(request_context) {
                 return Ok(None);
             }
-            Ok(Some(build_admin_users_maintenance_response()))
+            Ok(Some(build_admin_users_data_unavailable_response()))
         }
     }
 }

apps/aether-gateway/src/handlers/admin/users/sessions.rs

@@ -1,4 +1,12 @@
-use super::*;
+use super::{build_admin_users_bad_request_response, format_optional_datetime_iso8601};
+use crate::gateway::{AppState, GatewayError, GatewayPublicRequestContext};
+use axum::{
+    body::Body,
+    http,
+    response::{IntoResponse, Response},
+    Json,
+};
+use serde_json::json;
 
 fn admin_user_id_from_sessions_path(request_path: &str) -> Option<String> {
     request_path

apps/aether-gateway/src/handlers/admin/users/shared.rs

@@ -1,4 +1,12 @@
-use super::*;
+use super::ADMIN_USERS_DATA_UNAVAILABLE_DETAIL;
+use axum::{
+    body::Body,
+    http,
+    response::{IntoResponse, Response},
+    Json,
+};
+use regex::Regex;
+use serde_json::json;
 
 #[derive(Debug, serde::Deserialize)]
 pub(super) struct AdminCreateUserApiKeyRequest {
@@ -93,10 +101,10 @@ pub(super) struct AdminUpdateUserFieldPresence {
     pub(super) allowed_models: bool,
 }
 
-pub(super) fn build_admin_users_maintenance_response() -> Response<Body> {
+pub(super) fn build_admin_users_data_unavailable_response() -> Response<Body> {
     (
         http::StatusCode::SERVICE_UNAVAILABLE,
-        Json(json!({ "detail": ADMIN_USERS_RUST_BACKEND_DETAIL })),
+        Json(json!({ "detail": ADMIN_USERS_DATA_UNAVAILABLE_DETAIL })),
     )
         .into_response()
 }