fix(api): return 400 instead of 500 for DeleteObjects size limit

[skshetry]

Relates to #9993

Change Description

Background

When the DeleteObjects API receives more than 1000 paths, it returns HTTP 500 Internal Server Error. This causes clients to retry the request unnecessarily since 5xx errors are typically retried.

Bug Fix

1. Problem - DeleteObjects returns HTTP 500 for request size validation errors, causing unnecessary retries.

2. Root cause - The size limit check was using http.StatusInternalServerError instead of a 4xx client error:

   lakeFS/pkg/api/controller.go

   Lines 697 to 701 in 2f26953

   	if len(body.Paths) > DefaultMaxDeleteObjects {
   	err := fmt.Errorf("%w, max paths is set to %d", ErrRequestSizeExceeded, DefaultMaxDeleteObjects)
   	writeError(w, r, http.StatusInternalServerError, err)
   	return
   	}

   
   

   lakeFS/cmd/lakectl/cmd/retry_client.go

   Lines 102 to 106 in 7cc7189

   	var lakectlDefaultRetryStatuses = ShouldRetryer{
   	http.StatusTooManyRequests,
   	http.StatusInternalServerError,
   	http.StatusServiceUnavailable,
   	}

3. Solution - Return HTTP 400 Bad Request instead, matching AWS S3 behavior. This prevents unnecessary retries since 4xx errors indicate client errors that won't succeed on retry.

Testing Details

• Existing unit tests pass
• Code compiles successfully

Breaking Change?

No - this changes an error response code from 500 to 400, which is a more accurate status code for this validation error.

[skshetry]

I know we have the test below, but I think BadRequest makes more sense here than InternalServerError, so I thought I'd propose.

[nopcoder]

LGTM!