fix(s3api): reject zero default retention years (#9860)

Problem: Default object-lock retention accepted an explicitly provided Years value of zero, even though a default retention period must be positive when present.

Root cause: validateDefaultRetention rejected zero Days but only rejected negative Years, leaving YearsSet with Years=0 as a successful validation path.

Fix: Treat an explicitly provided zero Years value as ErrInvalidRetentionPeriod, matching the existing Days validation.

Reproduction: go test ./weed/s3api -run TestValidateDefaultRetention -count=1 failed before the fix because the Zero years case returned nil.

Validation: go test ./weed/s3api -run TestValidateDefaultRetention -count=1; go test ./weed/s3api -count=1; git diff --check; git diff --cached --check

weed/s3api/s3api_object_retention_test.go

@@ -786,6 +786,16 @@ func TestValidateDefaultRetention(t *testing.T) {
 			expectError: true,
 			errorMsg:    "default retention must specify either Days or Years",
 		},
+		{
+			name: "Zero years",
+			retention: &DefaultRetention{
+				Mode:     "GOVERNANCE",
+				Years:    0,
+				YearsSet: true,
+			},
+			expectError: true,
+			errorMsg:    "invalid retention period specified",
+		},
 	}
 
 	for _, tt := range tests {