s3tables: Pre-validate namespace to return 400 instead of 500

Move validateNamespace call outside of filerClient.WithFilerClient closure
so that validation errors return HTTP 400 (InvalidRequest) instead of 500
(InternalError).

Before: Validation error inside closure → treated as internal error → 500
After: Validation error before closure → handled as bad request → 400

This provides correct error semantics: namespace validation is an input
validation issue, not a server error.

weed/s3api/s3tables/handler_table.go

@@ -293,18 +293,24 @@ func (h *S3TablesHandler) handleListTables(w http.ResponseWriter, r *http.Reques
 		return fmt.Errorf("invalid maxTables value: %d", maxTables)
 	}
 
+	// Pre-validate namespace before calling WithFilerClient to return 400 on validation errors
+	var namespaceName string
+	if len(req.Namespace) > 0 {
+		var err error
+		namespaceName, err = validateNamespace(req.Namespace)
+		if err != nil {
+			h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+			return err
+		}
+	}
+
 	var tables []TableSummary
 	var paginationToken string
 
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 		var err error
 		if len(req.Namespace) > 0 {
-			namespaceName, err := validateNamespace(req.Namespace)
-			if err != nil {
-				return err
-			}
-
-			// Check permission (check namespace ownership)
+			// Namespace has already been validated above
 			namespacePath := getNamespacePath(bucketName, namespaceName)
 			var nsMeta namespaceMetadata
 			data, err := h.getExtendedAttribute(r.Context(), client, namespacePath, ExtendedKeyMetadata)