[BUG] RegistryController.delete and NamespaceController.delete accept an empty id list, producing invalid `IN ()` SQL

- severity: Medium
- files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/RegistryController.java:110`; `shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/NamespaceController.java:106`; `shenyu-admin/src/main/resources/mappers/registry-sqlmap.xml:260-266`; `shenyu-admin/src/main/resources/mappers/namespace-sqlmap.xml:246-252`
- description: Both endpoints use `@RequestBody final List<@NotBlank String> ids` but omit `@NotEmpty` (contrast with AppAuthController, PluginController which use `@RequestBody @NotEmpty final List<@NotBlank String> ids`). An empty list passes the per-element `@NotBlank` check vacuously and reaches `deleteByIds(ids)`, whose XML renders `WHERE id IN ` — with an empty collection yields `DELETE ... WHERE id IN ()`, a SQL syntax error.
- impact: An authenticated user can trigger an unhandled SQL exception / HTTP 500 (and a stack-trace leak) by POSTing `[]`.
- suggested_fix: Add `@NotEmpty` to both `@RequestBody List<...>` parameters.
- confidence: High
- related_existing: none.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Start with the delete methods at the referenced lines in RegistryController.java and NamespaceController.java, then compare their request validation with AppAuthController and PluginController. Check the corresponding deleteByIds mappings in registry-sqlmap.xml and namespace-sqlmap.xml, and run the relevant admin tests. Done means an empty list is rejected before reaching the mapper and no invalid SQL or HTTP 500 occurs.

Written by the indexing model from the issue text.