Validate Entities and Return 400

Currently when creating entities such as a Site or Organization a validation layer by the data layer (e.g. due to a missing required property) will cause a HTTP Status of 500 instead of 400.

- [ ] Update API spec to feature relevant 400 reponses
- [ ] Update API controllers to validate an entity (e.g. by using `createSite` et al directly) and returning `badRequest`

Start with the API specification and API controllers, then trace entity creation through methods such as `createSite` to identify where data-layer validation becomes HTTP 500. Update the documented 400 responses and verify controllers return `badRequest` for missing required properties across entities such as Site and Organization.

Written by the indexing model from the issue text.