Closes the coverage gap noted in CLAUDE.md's "Việc còn dở" — mirrors the existing pattern in tests/licenses.test.ts and tests/assignments.test.ts for POST /api/assets, POST /api/employees, POST /api/requests (the only body- accepting methods on these three routes; none have a PATCH route yet).