try adding validations via postgresql constraints

[facundoolano]

https://begriffs.com/posts/2017-10-21-sql-domain-integrity.html

ideally try adding the constraints to the sql, with error messages and try to expose those in the api errors.

related to #19