The DELETE route accepted params.id as any string, but the downstream
CUD delete handler validates it against a UUID schema. A malformed id
therefore failed inside the handler as a HexclaveAssertionError (500)
instead of a request-validation error. Constraining params.id to a UUID
keeps invalid input on the 400 path.