admin: reject slash-bearing table names at create time (Codex P2)

handleDescribe and handleDelete already 404 on names containing '/',
so a user could create `foo/bar` and then never be able to manage
it through the admin surface — orphaned tables would only be
reachable via the SigV4 path, which is exactly the asymmetry Codex
flagged.

validateCreateTableRequest now rejects '/' before the request
reaches the source. Tests cover single-slash and multi-slash
names alongside the existing trailing-JSON / unknown-field cases.

Author: bootjp

internal/admin/dynamo_handler.go

@@ -389,6 +389,16 @@ func validateCreateTableRequest(in *CreateTableRequest) error {
 	if strings.TrimSpace(in.TableName) == "" {
 		return errors.New("table_name is required")
 	}
+	// Reject slash-bearing names symmetrically with handleDescribe
+	// and handleDelete, which already 404 on `/`. Without this
+	// guard a user could create `foo/bar` and then never be able
+	// to describe or delete it through the same admin surface —
+	// the orphaned table would be reachable only through the SigV4
+	// path. Blocking the asymmetric edge case at create time is
+	// strictly better than discovering it later.
+	if strings.ContainsRune(in.TableName, '/') {
+		return errors.New("table_name must not contain '/'")
+	}
 	if err := validateAttribute(in.PartitionKey, "partition_key"); err != nil {
 		return err
 	}

internal/admin/dynamo_handler_test.go

@@ -93,7 +93,6 @@ func (s *stubTablesSource) AdminDeleteTable(_ context.Context, principal AuthPri
 	return nil
 }
 
-
 func newDynamoHandlerForTest(src TablesSource) *DynamoHandler {
 	return NewDynamoHandler(src)
 }
@@ -440,6 +439,8 @@ func TestDynamoHandler_CreateTable_RejectsBadJSON(t *testing.T) {
 		`{"table_name":"u","partition_key":{"name":"id","type":"S"},"unknown_field":1}`,                 // strict decode
 		`{"table_name":"u","partition_key":{"name":"id","type":"S"}}{"second":"object"}`,                // trailing JSON
 		`{"table_name":"u","partition_key":{"name":"id","type":"S"}} 42`,                                // trailing scalar
+		`{"table_name":"foo/bar","partition_key":{"name":"id","type":"S"}}`,                             // slash in name
+		`{"table_name":"a/b/c","partition_key":{"name":"id","type":"S"}}`,                               // multiple slashes
 	}
 	for _, body := range cases {
 		t.Run(body, func(t *testing.T) {