refactor: 移除 Python upstream 依赖，清理全部 legacy/Python 兼容层

- 移除 upstream_base_url 参数及 AETHER_GATEWAY_UPSTREAM 环境变量，gateway 不再需要指向 Python 宿主
- 删除所有 LEGACY_*/PYTHON_* 常量、路由组、header 定义及 sunset/phaseout 机制
- 将 legacy_gateway_bridge 重命名为 internal_gateway，executor 相关命名统一为 execution_runtime
- dev.sh 新增 Postgres/Redis 预检查，移除 upstream 相关启动参数和提示
- 新增 ai_public 路由处理器
- 全量适配 handler、test、state、control 等模块的命名和接口变更

apps/aether-gateway/src/handlers/proxy/finalize.rs

@@ -1,4 +1,18 @@
-use super::*;
+use crate::gateway::constants::{
+    CONTROL_ENDPOINT_SIGNATURE_HEADER, CONTROL_EXECUTION_RUNTIME_HEADER,
+    CONTROL_ROUTE_CLASS_HEADER, CONTROL_ROUTE_FAMILY_HEADER, CONTROL_ROUTE_KIND_HEADER,
+    DEPENDENCY_REASON_HEADER, EXECUTION_PATH_HEADER, LOCAL_EXECUTION_RUNTIME_MISS_REASON_HEADER,
+    TRACE_ID_HEADER,
+};
+use crate::gateway::{
+    record_shadow_result_non_blocking, AppState, GatewayControlDecision,
+    GatewayPublicRequestContext,
+};
+use aether_runtime::{maybe_hold_axum_response_permit, AdmissionPermit};
+use axum::body::{Body, Bytes};
+use axum::http::{self, header::HeaderName, header::HeaderValue, Response};
+use std::time::Instant;
+use tracing::info;
 
 pub(super) fn request_wants_stream(
     request_context: &GatewayPublicRequestContext,
@@ -37,25 +51,27 @@ pub(super) fn finalize_gateway_response(
     started_at: &Instant,
     request_permit: Option<AdmissionPermit>,
 ) -> Response<Body> {
+    attach_control_decision_headers(&mut response, control_decision);
+    if !response.headers().contains_key(TRACE_ID_HEADER) {
+        response.headers_mut().insert(
+            HeaderName::from_static(TRACE_ID_HEADER),
+            HeaderValue::from_str(trace_id).expect("trace id should be a valid header value"),
+        );
+    }
     response.headers_mut().insert(
         HeaderName::from_static(EXECUTION_PATH_HEADER),
         HeaderValue::from_static(execution_path),
     );
 
     let elapsed_ms = started_at.elapsed().as_millis() as u64;
-    let python_dependency_reason = response
+    let dependency_reason = response
         .headers()
-        .get(PYTHON_DEPENDENCY_REASON_HEADER)
+        .get(DEPENDENCY_REASON_HEADER)
         .and_then(|value| value.to_str().ok())
         .unwrap_or("none");
     let local_execution_runtime_miss_reason = response
         .headers()
         .get(LOCAL_EXECUTION_RUNTIME_MISS_REASON_HEADER)
-        .or_else(|| {
-            response
-                .headers()
-                .get(LOCAL_LEGACY_EXECUTION_RUNTIME_MISS_REASON_HEADER)
-        })
         .and_then(|value| value.to_str().ok())
         .unwrap_or("none");
     info!(
@@ -67,7 +83,7 @@ pub(super) fn finalize_gateway_response(
             .and_then(|decision| decision.route_class.as_deref())
             .unwrap_or("passthrough"),
         execution_path,
-        python_dependency_reason,
+        dependency_reason,
         local_execution_runtime_miss_reason,
         status = response.status().as_u16(),
         elapsed_ms,
@@ -87,6 +103,70 @@ pub(super) fn finalize_gateway_response(
     maybe_hold_axum_response_permit(response, request_permit)
 }
 
+fn attach_control_decision_headers(
+    response: &mut Response<Body>,
+    control_decision: Option<&GatewayControlDecision>,
+) {
+    let Some(control_decision) = control_decision else {
+        return;
+    };
+    if !response.headers().contains_key(CONTROL_ROUTE_CLASS_HEADER) {
+        response.headers_mut().insert(
+            HeaderName::from_static(CONTROL_ROUTE_CLASS_HEADER),
+            HeaderValue::from_str(
+                control_decision
+                    .route_class
+                    .as_deref()
+                    .unwrap_or("passthrough"),
+            )
+            .expect("route class should be a valid header value"),
+        );
+    }
+    if !response
+        .headers()
+        .contains_key(CONTROL_EXECUTION_RUNTIME_HEADER)
+    {
+        response.headers_mut().insert(
+            HeaderName::from_static(CONTROL_EXECUTION_RUNTIME_HEADER),
+            HeaderValue::from_static(if control_decision.is_execution_runtime_candidate() {
+                "true"
+            } else {
+                "false"
+            }),
+        );
+    }
+    if let Some(route_family) = control_decision.route_family.as_deref() {
+        if !response.headers().contains_key(CONTROL_ROUTE_FAMILY_HEADER) {
+            response.headers_mut().insert(
+                HeaderName::from_static(CONTROL_ROUTE_FAMILY_HEADER),
+                HeaderValue::from_str(route_family)
+                    .expect("route family should be a valid header value"),
+            );
+        }
+    }
+    if let Some(route_kind) = control_decision.route_kind.as_deref() {
+        if !response.headers().contains_key(CONTROL_ROUTE_KIND_HEADER) {
+            response.headers_mut().insert(
+                HeaderName::from_static(CONTROL_ROUTE_KIND_HEADER),
+                HeaderValue::from_str(route_kind)
+                    .expect("route kind should be a valid header value"),
+            );
+        }
+    }
+    if let Some(endpoint_signature) = control_decision.auth_endpoint_signature.as_deref() {
+        if !response
+            .headers()
+            .contains_key(CONTROL_ENDPOINT_SIGNATURE_HEADER)
+        {
+            response.headers_mut().insert(
+                HeaderName::from_static(CONTROL_ENDPOINT_SIGNATURE_HEADER),
+                HeaderValue::from_str(endpoint_signature)
+                    .expect("endpoint signature should be a valid header value"),
+            );
+        }
+    }
+}
+
 pub(super) fn finalize_gateway_response_with_context(
     state: &AppState,
     response: Response<Body>,