POST/GET /api/employees, same thin-route pattern as src/app/api/requests/route.ts including the auth() 401 check (middleware.ts excludes /api from page-route gating). POST also surfaces createEmployee()'s FK-violation translation (nonexistent managerId) as a 400, not a raw 500.