Exercise 1: Demonstrating the Missing Validation — Possible Solution
====================================================================

THE REQUEST
------------------------------
fetch('/api/pages/3/title', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ title: 12345 }),
});

WHAT HAPPENS WITH THE CHAPTER'S OWN UNVALIDATED ENDPOINT
------------------------------
The endpoint destructures title straight out of the request body with
no type check at all, and passes it directly into
db.update(pages).set({ title }). The database column accepts it
(MySQL coerces the numeric value into its own varchar column), so
page 3's own title row now literally reads "12345" - a value that
never should have been accepted as a page title, written with zero
resistance.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly sends a request no properly-validated endpoint should
accept, and correctly confirms the chapter's own version of the
endpoint writes it to the database anyway, demonstrating the real
absence of any validation layer.