test(09-05): add failing tests for scoped record lifecycle

- Record routes must enforce permission before ids or bodies and return D-10 envelopes
- Create, update, and delete run Before and After hooks once inside the transaction
- Out-of-scope and missing records are indistinguishable, and hook failure rolls back

cabana/http.go

@@ -165,6 +165,22 @@ func (s *service) translator() *phrasebook.Translator {
 	return tr
 }
 
+func (s *service) show(w http.ResponseWriter, r *http.Request) {
+	WriteError(w, http.StatusInternalServerError, "error", msgServerError)
+}
+
+func (s *service) create(w http.ResponseWriter, r *http.Request) {
+	WriteError(w, http.StatusInternalServerError, "error", msgServerError)
+}
+
+func (s *service) update(w http.ResponseWriter, r *http.Request) {
+	WriteError(w, http.StatusInternalServerError, "error", msgServerError)
+}
+
+func (s *service) deleteRecord(w http.ResponseWriter, r *http.Request) {
+	WriteError(w, http.StatusInternalServerError, "error", msgServerError)
+}
+
 func (s *service) list(w http.ResponseWriter, r *http.Request) {
 	s.protect(w, r, func(cc *CompiledController) {
 		db, err := s.db()