Mirrors tests/requests.test.ts's structure and @/auth mocking
pattern. Covers: successful create (with and without managerId),
empty name/department validation failures, malformed managerId UUID,
nonexistent managerId (FK violation -> friendly 400, not a raw 500),
a self-referential manager sanity check via direct Prisma update,
list ordering, empty list, and 401-when-unauthenticated for both
routes.
