feat: 扩展 Rust gateway 全功能模块，新增 billing/crypto/wallet crate 及完整数据层

- 新增 aether-billing、aether-crypto、aether-wallet 独立 crate
- aether-data 扩展 repository 层：announcements、auth_modules、billing、
  candidate_selection、gemini_file_mappings、global_models、management_tokens、
  oauth_providers、proxy_nodes、quota、users、wallet 等模块
- aether-gateway 新增 api/auth/billing/control/middleware/scheduler/usage/
  video_tasks/hooks/maintenance/model_fetch/provider_transport 等功能模块
- 重构 executor decision 和 gateway state 为模块目录结构
- 新增 gateway router、frontdoor 路由层及对应测试
- Python 侧 API 路由重构，新增 compat/support 模块
- 前端 Logo 组件更新及 Provider 管理页面调整

tests/unit/test_admin_system_users_export_import.py

@@ -79,3 +79,14 @@ def test_import_new_standalone_key_null_rate_limit_keeps_inherit_semantics() ->
         )
         is None
     )
+
+
+def test_import_access_list_accepts_stringified_json_array() -> None:
+    assert AdminImportUsersAdapter._normalize_imported_access_list('["openai", " gemini "]') == [
+        "openai",
+        "gemini",
+    ]
+
+
+def test_import_access_list_wraps_single_string() -> None:
+    assert AdminImportUsersAdapter._normalize_imported_access_list("openai") == ["openai"]

tests/unit/test_api_request_context.py

@@ -58,6 +58,8 @@ def _build_context(raw_body: bytes, headers: dict[str, str] | None = None) -> Ap
         api_key=None,
         request_id="req_test",
         start_time=0.0,
+        request_method="POST",
+        request_path="/v1/messages",
         client_ip="127.0.0.1",
         user_agent="pytest",
         original_headers=headers or {},
@@ -67,6 +69,74 @@ def _build_context(raw_body: bytes, headers: dict[str, str] | None = None) -> Ap
 
 
 class TestApiRequestContextEnsureJsonBody:
+    def test_build_prefers_request_state_request_id_over_trace_header(self) -> None:
+        request = _build_request(headers={"x-trace-id": "trace-frontdoor-123"})
+        request.state.request_id = "state-rid-001"
+
+        context = ApiRequestContext.build(
+            request=request,
+            db=None,  # type: ignore[arg-type]
+            user=None,
+            api_key=None,
+            raw_body=b"{}",
+        )
+
+        assert context.request_id == "state-rid-001"
+        assert request.state.request_id == "state-rid-001"
+
+    def test_build_prefers_trace_header_for_request_id(self) -> None:
+        request = _build_request(headers={"x-trace-id": "trace-frontdoor-123"})
+
+        context = ApiRequestContext.build(
+            request=request,
+            db=None,  # type: ignore[arg-type]
+            user=None,
+            api_key=None,
+            raw_body=b"{}",
+        )
+
+        assert context.request_id == "trace-frontdoor-123"
+        assert request.state.request_id == "trace-frontdoor-123"
+
+    def test_build_snapshots_request_method_path_and_path_params(self) -> None:
+        request = _build_request(headers={"x-trace-id": "trace-frontdoor-123"})
+        request.scope["method"] = "GET"
+        request.scope["path"] = "/v1beta/models/gemini-2.5-pro:generateContent"
+        request.scope["raw_path"] = b"/v1beta/models/gemini-2.5-pro:generateContent"
+        request.scope["path_params"] = {"model": "gemini-2.5-pro"}
+
+        context = ApiRequestContext.build(
+            request=request,
+            db=None,  # type: ignore[arg-type]
+            user=None,
+            api_key=None,
+            raw_body=b"{}",
+        )
+
+        assert context.request_method == "GET"
+        assert context.request_path == "/v1beta/models/gemini-2.5-pro:generateContent"
+        assert context.path_params == {"model": "gemini-2.5-pro"}
+
+    def test_build_snapshots_request_runtime_state(self) -> None:
+        request = _build_request(headers={"x-trace-id": "trace-frontdoor-123"})
+        request.state.prefetched_balance_remaining = "12.5"
+        request.state.gateway_execution_path = "public_proxy_after_executor_miss"
+        request.state.rate_limit_scope = "user"
+        request.state.tx_committed_by_route = True
+
+        context = ApiRequestContext.build(
+            request=request,
+            db=None,  # type: ignore[arg-type]
+            user=None,
+            api_key=None,
+            raw_body=b"{}",
+        )
+
+        assert context.prefetched_balance_remaining == 12.5
+        assert context.gateway_execution_path == "public_proxy_after_executor_miss"
+        assert context.rate_limit_scope == "user"
+        assert context.tx_committed_by_route is True
+
     def test_decompresses_gzip_body(self) -> None:
         payload = {"message": "hello", "count": 2}
         raw_body = gzip.compress(json.dumps(payload).encode("utf-8"))
@@ -88,6 +158,7 @@ class TestApiRequestContextEnsureJsonBody:
     def test_build_records_client_encoding_preferences(self) -> None:
         request = _build_request(
             headers={
+                "content-type": "application/json",
                 "content-encoding": "gzip",
                 "accept-encoding": "gzip, deflate",
             }
@@ -102,6 +173,31 @@ class TestApiRequestContextEnsureJsonBody:
 
         assert context.client_content_encoding == "gzip"
         assert context.client_accept_encoding == "gzip, deflate"
+        assert context.request_content_type == "application/json"
+
+    def test_build_records_perf_only_when_payload_not_empty(self) -> None:
+        request = _build_request(headers={"x-trace-id": "trace-frontdoor-123"})
+        request.state.perf_metrics = {}
+        context = ApiRequestContext.build(
+            request=request,
+            db=None,  # type: ignore[arg-type]
+            user=None,
+            api_key=None,
+            raw_body=b"{}",
+        )
+        assert "perf" not in context.extra
+
+        request_with_perf = _build_request(headers={"x-trace-id": "trace-frontdoor-456"})
+        request_with_perf.state.perf_metrics = {"pipeline": {"auth_ms": 3}}
+        context_with_perf = ApiRequestContext.build(
+            request=request_with_perf,
+            db=None,  # type: ignore[arg-type]
+            user=None,
+            api_key=None,
+            raw_body=b"{}",
+        )
+        assert context_with_perf.extra["perf"] == {"pipeline": {"auth_ms": 3}}
+        assert context_with_perf.perf_metrics == {"pipeline": {"auth_ms": 3}}
 
     @pytest.mark.asyncio
     async def test_ensure_json_body_async_loads_body_lazily(self) -> None:

tests/unit/test_executor_plan.py

@@ -9,6 +9,7 @@ from src.services.request.executor_plan import (
     ExecutionPlanTimeouts,
     ExecutionProxySnapshot,
     build_execution_plan_body,
+    should_bypass_remote_executor_url,
 )
 
 
@@ -342,3 +343,43 @@ def test_prepared_execution_plan_remote_eligible_allows_empty_get_body() -> None
     )
 
     assert prepared.remote_eligible is True
+
+
+def test_prepared_execution_plan_remote_eligible_rejects_codex_cli_transport() -> None:
+    prepared = PreparedExecutionPlan(
+        contract=ExecutionPlan(
+            request_id="req-1",
+            candidate_id=None,
+            provider_name="codex",
+            provider_id="prov-1",
+            endpoint_id="ep-1",
+            key_id="key-1",
+            method="POST",
+            url="https://chatgpt.com/backend-api/codex/responses",
+            headers={"content-type": "application/json"},
+            body=ExecutionPlanBody(json_body={"model": "gpt-5.4", "input": []}),
+            stream=True,
+            provider_api_format="openai:cli",
+            client_api_format="openai:cli",
+            model_name="gpt-5.4",
+        ),
+        payload={"model": "gpt-5.4", "input": []},
+        headers={"content-type": "application/json"},
+        upstream_is_stream=True,
+        needs_conversion=False,
+        provider_type="codex",
+        request_timeout=30.0,
+    )
+
+    assert prepared.remote_eligible is False
+
+
+def test_should_bypass_remote_executor_url_accepts_backendapi_codex_variant() -> None:
+    assert (
+        should_bypass_remote_executor_url(
+            "https://chatgpt.com/backendapi/codex/responses",
+            provider_api_format="openai:cli",
+            client_api_format="openai:cli",
+        )
+        is True
+    )

tests/unit/test_provider_oauth_refresh_error.py

@@ -1,10 +1,43 @@
 from __future__ import annotations
 
 import httpx
+import pytest
+from types import SimpleNamespace
 
 from src.api.admin import provider_oauth as module
 
 
+class _SingleKeyQuery:
+    def __init__(self, key: object) -> None:
+        self._key = key
+
+    def filter(self, *_args: object, **_kwargs: object) -> "_SingleKeyQuery":
+        return self
+
+    def first(self) -> object:
+        return self._key
+
+
+class _SingleKeyDB:
+    def __init__(self, key: object) -> None:
+        self._key = key
+
+    def query(self, _model: object) -> _SingleKeyQuery:
+        return _SingleKeyQuery(self._key)
+
+
+class _FakeDBContext:
+    def __init__(self, db: _SingleKeyDB) -> None:
+        self._db = db
+
+    def __enter__(self) -> _SingleKeyDB:
+        return self._db
+
+    def __exit__(self, exc_type: object, exc: object, tb: object) -> bool:
+        _ = exc_type, exc, tb
+        return False
+
+
 def test_extract_oauth_refresh_error_reason_for_reused_refresh_token() -> None:
     response = httpx.Response(
         400,
@@ -54,3 +87,50 @@ def test_merge_refresh_failure_reason_keeps_account_block_and_appends_refresh_fa
         "[ACCOUNT_BLOCK] 工作区已停用 (deactivated_workspace)\n"
         "[REFRESH_FAILED] Token 续期失败 (400): refresh_token_reused"
     )
+
+
+def test_merge_refresh_failure_reason_keeps_oauth_expired_sticky() -> None:
+    current_reason = "[OAUTH_EXPIRED] Token 已过期且续期失败"
+    refresh_reason = "[REFRESH_FAILED] Token 续期失败 (400): refresh_token_reused"
+
+    assert module._merge_refresh_failure_reason(current_reason, refresh_reason) is None
+
+
+@pytest.mark.parametrize(
+    ("initial_reason", "should_clear"),
+    [
+        ("[REFRESH_FAILED] Token 续期失败 (401): refresh_token_reused", True),
+        ("[ACCOUNT_BLOCK] Google requires verification", False),
+    ],
+)
+def test_store_refreshed_oauth_sync_only_clears_recoverable_invalid_markers(
+    monkeypatch: pytest.MonkeyPatch,
+    initial_reason: str,
+    should_clear: bool,
+) -> None:
+    key = SimpleNamespace(
+        id="key-1",
+        api_key="old-api",
+        auth_config="old-config",
+        oauth_invalid_at="old-invalid-at",
+        oauth_invalid_reason=initial_reason,
+    )
+    db = _SingleKeyDB(key)
+
+    monkeypatch.setattr(module, "get_db_context", lambda: _FakeDBContext(db))
+    monkeypatch.setattr(module.crypto_service, "encrypt", lambda value: f"enc:{value}")
+
+    module._store_refreshed_oauth_sync(
+        "key-1",
+        "new-token",
+        {"refresh_token": "rt-2"},
+    )
+
+    assert key.api_key == "enc:new-token"
+    assert key.auth_config == 'enc:{"refresh_token": "rt-2"}'
+    if should_clear:
+        assert key.oauth_invalid_at is None
+        assert key.oauth_invalid_reason is None
+    else:
+        assert key.oauth_invalid_at == "old-invalid-at"
+        assert key.oauth_invalid_reason == initial_reason

tests/unit/test_request_utils.py

@@ -0,0 +1,110 @@
+from __future__ import annotations
+
+from starlette.requests import Request
+
+from src.utils.request_utils import (
+    get_request_id,
+    get_request_identity_metadata,
+    get_request_metadata,
+    update_request_state,
+)
+
+
+def _build_request(headers: dict[str, str] | None = None) -> Request:
+    header_items = [
+        (str(key).encode("latin-1"), str(value).encode("latin-1"))
+        for key, value in (headers or {}).items()
+    ]
+    scope = {
+        "type": "http",
+        "http_version": "1.1",
+        "method": "GET",
+        "scheme": "http",
+        "path": "/health",
+        "raw_path": b"/health",
+        "query_string": b"",
+        "headers": header_items,
+        "client": ("127.0.0.1", 12345),
+        "server": ("testserver", 80),
+    }
+
+    async def receive() -> dict[str, object]:
+        return {"type": "http.request", "body": b"", "more_body": False}
+
+    return Request(scope, receive)
+
+
+def test_get_request_id_prefers_request_state() -> None:
+    request = _build_request(headers={"x-trace-id": "trace-header-123"})
+    request.state.request_id = "req-state-123"
+
+    assert get_request_id(request) == "req-state-123"
+
+
+def test_get_request_id_falls_back_to_trace_header() -> None:
+    request = _build_request(headers={"x-trace-id": "trace-header-123"})
+
+    assert get_request_id(request) == "trace-header-123"
+
+
+def test_get_request_id_returns_none_without_state_or_trace_header() -> None:
+    request = _build_request()
+
+    assert get_request_id(request) is None
+
+
+def test_update_request_state_sets_selected_fields() -> None:
+    request = _build_request()
+
+    update_request_state(
+        request,
+        request_id="req-123",
+        user_id="user-123",
+        api_key_id="key-123",
+        gateway_execution_path="executor_sync",
+        rate_limit_scope="user",
+    )
+
+    assert request.state.request_id == "req-123"
+    assert request.state.user_id == "user-123"
+    assert request.state.api_key_id == "key-123"
+    assert request.state.gateway_execution_path == "executor_sync"
+    assert request.state.rate_limit_scope == "user"
+
+
+def test_get_request_identity_metadata_reads_request_id_client_ip_and_user_agent() -> None:
+    request = _build_request(
+        headers={
+            "x-trace-id": "trace-header-abc",
+            "x-real-ip": "203.0.113.7",
+            "user-agent": "pytest-agent",
+        }
+    )
+
+    meta = get_request_identity_metadata(request)
+
+    assert meta.request_id == "trace-header-abc"
+    assert meta.client_ip == "203.0.113.7"
+    assert meta.user_agent == "pytest-agent"
+
+
+def test_get_request_metadata_reuses_identity_fields() -> None:
+    request = _build_request(
+        headers={
+            "x-trace-id": "trace-xyz",
+            "x-real-ip": "198.51.100.23",
+            "user-agent": "pytest-meta-agent",
+            "content-type": "application/json",
+            "content-length": "42",
+        }
+    )
+
+    metadata = get_request_metadata(request)
+
+    assert metadata["request_id"] == "trace-xyz"
+    assert metadata["client_ip"] == "198.51.100.23"
+    assert metadata["user_agent"] == "pytest-meta-agent"
+    assert metadata["method"] == "GET"
+    assert metadata["path"] == "/health"
+    assert metadata["content_type"] == "application/json"
+    assert metadata["content_length"] == "42"