admin: canonicalise GSI projection_type at validation (Codex P2)

validateGSI accepted case-insensitive projection values for SPA
ergonomics, but only validated them — the original (possibly
lowercase) string then flowed through the bridge to the adapter,
where buildCreateTableProjection only matches exact uppercase. So
"include" passed handler validation only to fail later at the
adapter as ValidationException. Codex P2 flagged this as a
boundary mismatch on PR #635.

Fix: validateGSI now writes the uppercase form back to
gsi.Projection.Type when the value is recognised. Every downstream
consumer (the adapter bridge in main_admin.go and the AdminForward
server's handleCreate) sees the canonical shape.

Tests: round-trip "include" through the handler and confirm
src.lastCreateInput.GSI[0].Projection.Type is "INCLUDE"; sweep the
five mixed-case variants ALL/All/all + KEYS_ONLY/keys_only +
Include to confirm 201 in every case.

Author: bootjp

internal/admin/dynamo_handler.go

@@ -438,8 +438,20 @@ func validateGSI(gsi *CreateTableGSI, index int) error {
 			return err
 		}
 	}
-	switch strings.TrimSpace(strings.ToUpper(gsi.Projection.Type)) {
+	// Canonicalise the projection type in-place. The handler
+	// accepts case-insensitive input ("include" / "ALL") for SPA
+	// ergonomics, but the adapter's buildCreateTableProjection
+	// only matches exact uppercase. Normalising once at the
+	// boundary keeps that mismatch from surfacing as a confusing
+	// post-validation 500 — the bridge and the AdminForward server
+	// both forward whatever ends up in this field, so writing back
+	// the canonical form here means every downstream consumer sees
+	// the same shape. The empty string keeps its meaning ("default
+	// to ALL") on both sides.
+	canonical := strings.TrimSpace(strings.ToUpper(gsi.Projection.Type))
+	switch canonical {
 	case "", "ALL", "KEYS_ONLY", "INCLUDE":
+		gsi.Projection.Type = canonical
 		return nil
 	default:
 		return errors.New(prefix + `.projection.type must be one of "ALL", "KEYS_ONLY", "INCLUDE"`)

internal/admin/dynamo_handler_test.go

@@ -398,6 +398,67 @@ func TestDynamoHandler_CreateTable_HappyPath(t *testing.T) {
 	require.Equal(t, "id", got.PartitionKey)
 }
 
+// TestDynamoHandler_CreateTable_CanonicalisesProjectionType makes
+// sure validateGSI normalises a lowercase "include" value back to
+// the uppercase form the adapter expects. Without normalisation
+// the request would pass handler validation only to fail at the
+// adapter as ValidationException ("invalid projection") — exactly
+// the boundary mismatch Codex P2 flagged on PR #635.
+func TestDynamoHandler_CreateTable_CanonicalisesProjectionType(t *testing.T) {
+	src := &stubTablesSource{tables: map[string]*DynamoTableSummary{}}
+	h := newDynamoHandlerForTest(src)
+	body := `{
+		"table_name":"t",
+		"partition_key":{"name":"id","type":"S"},
+		"gsi":[{
+			"name":"by-status",
+			"partition_key":{"name":"status","type":"S"},
+			"projection":{"type":"include","non_key_attributes":["author"]}
+		}]
+	}`
+	req := httptest.NewRequest(http.MethodPost, pathDynamoTables, strings.NewReader(body))
+	req = withWritePrincipal(req)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	require.Equal(t, http.StatusCreated, rec.Code, rec.Body.String())
+	require.Len(t, src.lastCreateInput.GSI, 1)
+	require.Equal(t, "INCLUDE", src.lastCreateInput.GSI[0].Projection.Type,
+		"projection type must reach the source canonicalised so the adapter does not re-reject it")
+}
+
+// TestDynamoHandler_CreateTable_AcceptsMixedCaseProjection covers
+// the same canonicalisation for KEYS_ONLY / Keys_Only / keys_only.
+func TestDynamoHandler_CreateTable_AcceptsMixedCaseProjection(t *testing.T) {
+	cases := []struct{ in, want string }{
+		{"all", "ALL"},
+		{"All", "ALL"},
+		{"KEYS_ONLY", "KEYS_ONLY"},
+		{"keys_only", "KEYS_ONLY"},
+		{"Include", "INCLUDE"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.in, func(t *testing.T) {
+			src := &stubTablesSource{tables: map[string]*DynamoTableSummary{}}
+			h := newDynamoHandlerForTest(src)
+			body := `{
+				"table_name":"t",
+				"partition_key":{"name":"id","type":"S"},
+				"gsi":[{
+					"name":"i",
+					"partition_key":{"name":"k","type":"S"},
+					"projection":{"type":"` + tc.in + `"}
+				}]
+			}`
+			req := httptest.NewRequest(http.MethodPost, pathDynamoTables, strings.NewReader(body))
+			req = withWritePrincipal(req)
+			rec := httptest.NewRecorder()
+			h.ServeHTTP(rec, req)
+			require.Equal(t, http.StatusCreated, rec.Code, rec.Body.String())
+			require.Equal(t, tc.want, src.lastCreateInput.GSI[0].Projection.Type)
+		})
+	}
+}
+
 func TestDynamoHandler_CreateTable_RejectsReadOnlyPrincipal(t *testing.T) {
 	src := &stubTablesSource{tables: map[string]*DynamoTableSummary{}}
 	h := newDynamoHandlerForTest(src)