[BUG] app_auth.updateSelective WHERE clause omits namespace_id (cross-namespace update)

- severity: Medium
- files: `shenyu-admin/src/main/resources/mappers/app-auth-sqlmap.xml:265-291` (updateSelective `WHERE id=#{id}`) vs `:251-263` (full `update` `WHERE id=#{id} AND namespace_id=#{namespaceId}`)
- description: The full `update` scopes by `id AND namespace_id`, but `updateSelective` (the path used by `AppAuthServiceImpl.createOrUpdate`) scopes only by `id` (verified). A caller that supplies an `id` belonging to namespace A can mutate an app_auth row from namespace B without a namespace match.
- impact: Potential cross-namespace tampering of app_auth when only an id is supplied and the namespace is not re-verified.
- suggested_fix: Add `AND namespace_id = #{namespaceId, jdbcType=VARCHAR}` to `updateSelective`'s WHERE.
- confidence: Medium
- related_existing: none. The baseline AppAuth issues (#6538-6540) are about updateDetail full-update nulling and path appName; this is the updateSelective WHERE clause.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Start with shenyu-admin/src/main/resources/mappers/app-auth-sqlmap.xml:265-291 and compare updateSelective with the full update at lines 251-263. Trace AppAuthServiceImpl.createOrUpdate to confirm the selective path and verify that an id from another namespace cannot be updated without a matching namespace_id.

Written by the indexing model from the issue text.