admin: refresh stale comment + add Retry-After assertion (Claude review)

Three follow-ups from Claude review on a8de663:

1) writeTablesError ErrTablesNotLeader comment said "follow-up PR" but
   the forwarder is in this PR. The arm is now reached only when no
   LeaderForwarder is wired (single-node / leader-only deployments);
   when one is configured, tryForwardCreate / tryForwardDelete
   intercept the error before writeTablesError is called. Refreshed
   the comment to reflect that.

2) TestDynamoHandler_ForwarderTransportErrorReturns503 (CREATE-side)
   was missing the Retry-After:1 assertion that its DELETE counterpart
   already had. Added it for parity, guards against a future change
   that drops Retry-After from writeForwardFailure on only one path.

3) TestDynamoHandler_ForwarderLeaderUnavailableReturns503_Delete and
   TestDynamoHandler_ForwarderTransportErrorReturns503_Delete passed a
   tables map into notLeaderSource, but notLeaderSource.AdminDeleteTable
   unconditionally returns ErrTablesNotLeader without consulting it.
   Dropped the no-op map init.

Author: bootjp

internal/admin/dynamo_handler.go

@@ -528,9 +528,10 @@ func (h *DynamoHandler) writeTablesError(w http.ResponseWriter, r *http.Request,
 		writeJSONError(w, http.StatusForbidden, "forbidden",
 			"this endpoint requires a full-access role")
 	case errors.Is(err, ErrTablesNotLeader):
-		// The follower→leader forwarding RPC (design 3.3) will
-		// catch this case in a follow-up PR. Until then, surface
-		// 503 + Retry-After: 1 so the SPA / curl can re-issue.
+		// Reached only when no LeaderForwarder is configured (single-
+		// node or leader-only deployments). When a forwarder is wired,
+		// tryForwardCreate / tryForwardDelete intercept ErrTablesNotLeader
+		// before writeTablesError is called.
 		w.Header().Set("Retry-After", "1")
 		writeJSONError(w, http.StatusServiceUnavailable, "leader_unavailable",
 			"this admin node is not the raft leader")

internal/admin/forward_integration_test.go

@@ -156,6 +156,7 @@ func TestDynamoHandler_ForwarderTransportErrorReturns503(t *testing.T) {
 	h.ServeHTTP(rec, req)
 
 	require.Equal(t, http.StatusServiceUnavailable, rec.Code)
+	require.Equal(t, "1", rec.Header().Get("Retry-After"))
 	require.NotContains(t, rec.Body.String(), "TX-1")
 	require.NotContains(t, rec.Body.String(), "transport sentinel")
 }
@@ -238,9 +239,10 @@ func TestDynamoHandler_ForwarderNotInvokedForNonNotLeaderError(t *testing.T) {
 // catches it and routes through writeForwardFailure.
 func TestDynamoHandler_ForwarderLeaderUnavailableReturns503_Delete(t *testing.T) {
 	fwd := &stubLeaderForwarder{deleteErr: ErrLeaderUnavailable}
-	src := &notLeaderSource{stubTablesSource: stubTablesSource{
-		tables: map[string]*DynamoTableSummary{"users": {Name: "users"}},
-	}}
+	// notLeaderSource.AdminDeleteTable unconditionally returns
+	// ErrTablesNotLeader, so the embedded stubTablesSource.tables
+	// map is never consulted — keep the construction minimal.
+	src := &notLeaderSource{}
 	h := NewDynamoHandler(src).WithLeaderForwarder(fwd)
 	req := httptest.NewRequest(http.MethodDelete, pathDynamoTables+"/users", nil)
 	req = withWritePrincipal(req)
@@ -261,9 +263,7 @@ func TestDynamoHandler_ForwarderLeaderUnavailableReturns503_Delete(t *testing.T)
 // strictly on the wire shape.
 func TestDynamoHandler_ForwarderTransportErrorReturns503_Delete(t *testing.T) {
 	fwd := &stubLeaderForwarder{deleteErr: errors.New("gRPC transport sentinel DEL-TX-1")}
-	src := &notLeaderSource{stubTablesSource: stubTablesSource{
-		tables: map[string]*DynamoTableSummary{"users": {Name: "users"}},
-	}}
+	src := &notLeaderSource{}
 	h := NewDynamoHandler(src).WithLeaderForwarder(fwd)
 	req := httptest.NewRequest(http.MethodDelete, pathDynamoTables+"/users", nil)
 	req = withWritePrincipal(req)