Add missing negative-path tests for REST handlers

[amirHdev]

A lot of the REST layer already has coverage, but some of the boring failure cases still need direct tests.

This issue is about tightening those branches so refactors are safer later.

Examples of what to cover:

• wrong HTTP method
• missing resource IDs
• malformed JSON request bodies
• not found responses
• tenant-hidden resources where that behavior matters

Suggested files:

• internal/adapter/rest/
• existing *_test.go files in that package

Acceptance criteria:

• add a few focused tests, not one giant test file
• keep the assertions straightforward
• no unnecessary mocking
• go test ./... passes

Notes:
This is a good issue for someone who wants to learn the handler layer and how the API behaves when requests go wrong.