Mirrors tests/requests.test.ts's structure and @/auth mocking pattern. Covers: successful create (with and without managerId), empty name/department validation failures, malformed managerId UUID, nonexistent managerId (FK violation -> friendly 400, not a raw 500), a self-referential manager sanity check via direct Prisma update, list ordering, empty list, and 401-when-unauthenticated for both routes.