[BUG] DiscoveryUpstreamServiceImpl.fetchAll NPE on null handler / discovery / selector / plugin

- severity: Medium
- files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/DiscoveryUpstreamServiceImpl.java:333-352`
- description: `discoveryHandlerMapper.selectById(discoveryHandlerId)` (335) is dereferenced at 339; `selectorMapper.selectByDiscoveryHandlerId(...)` (339) is dereferenced at 341; `pluginMapper.selectById(selectorDO.getPluginId()).getName()` at 342; `discoveryMapper.selectById(...)` (348) is dereferenced at 350. `fetchAll` is reached from `create`, `update`, and `updateBatch`, so a stale/invalid `discoveryHandlerId` triggers the NPE on the write path.
- impact: Creating/updating an upstream for a handler whose rel/discovery/plugin was deleted throws NPE instead of a clean error.
- suggested_fix: Validate each lookup, throwing a domain exception otherwise.
- confidence: Medium
- related_existing: none.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Start in shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/DiscoveryUpstreamServiceImpl.java at lines 333-352, then trace fetchAll from create, update, and updateBatch. Review each mapper lookup and confirm that stale handler, selector, plugin, or discovery data produces a clean domain error rather than an NPE; done means the invalid write path no longer dereferences null.

Written by the indexing model from the issue text.