5 cases: zero/negative userId -> BadRequest; user with no posts -> []; returns only requested user's posts (filters out other authors); ordered newest-first by createdAt. fails red.
