[BUG] ShenyuClientHttpRegistryController: all six register/offline @RequestBody endpoints lack @Valid

- severity: Medium
- files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/ShenyuClientHttpRegistryController.java:61,77,93,106,122,138`
- description: All six mutating endpoints (`registerMetadata`, `registerURI`, `registerApiDoc`, `registerDiscoveryConfig`, `registerMcpTools`, `offline`) take `@RequestBody` without `@Valid`, and the register DTOs carry no bean-validation annotations. Required fields like `appName`, `rpcType`, `host`, `contextPath` are never validated and are forwarded into the gateway registration pipeline as null. `registerApiDoc` (line 93) does not even default `namespaceId`.
- impact: A malformed or empty JSON body is accepted and published to the gateway, potentially creating metadata/URI/MCP records with null required fields that downstream services consume without null-checks, leading to NPEs or corrupt gateway config.
- suggested_fix: Add `@Valid` to each `@RequestBody` and add `@NotBlank`/`@NotNull` on required fields of the register DTOs.
- confidence: High
- related_existing: none — distinct from GOV-T1 (test coverage); this is a per-controller validation gap on externally-facing register endpoints.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Start in shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/ShenyuClientHttpRegistryController.java at lines 61, 77, 93, 106, 122, and 138, then locate the DTOs used by these six request bodies. Review which fields are required and how registerApiDoc handles namespaceId. Done means malformed bodies are rejected before reaching the gateway registration pipeline while valid registrations continue to work.

Written by the indexing model from the issue text.