internal/router: return 404 on meta/any with no includes; fix bulk id handler