TheftCase envelope with detail DTO and field specs

Invalid input. The code field disambiguates: BAD_REQUEST (missing/malformed id, missing/malformed body, body id mismatch, client-supplied id on POST), INVARIANT_VIOLATION (aggregate invariant failed), INVALID_TRANSITION (forbidden status transition), or CLOSED_CASE_LOCKED (mutation of a closed case).

Resource not found — the supplied id does not resolve to a Theft record type

Server error — unexpected exception or org configuration problem. The code field disambiguates: RECORD_TYPE_MISSING (Theft record type missing on Investigation__c) or INTERNAL_SERVER_ERROR (catch-all).