28 tests covering lib-level validation/CRUD and route-level HTTP behavior: malformed JSON, non-object body, invalid dataType, categoryId FK violation, duplicate (categoryId, key) rejected with a clean 400 (not 500), and same key allowed across two different categories (the "not globally unique" case), plus auth gating.