pong to Sly: add tests for sad path

Updated `document_controller_spec`:
- explicitly test the route `update_document_parent_id` instead of the private controller method (*controller tests should mainly focus on testing routes*)
- removed test for proxy-ing the call to a private method (*the test should not care if the controller uses private methods*)
- add additional test cases for the sad path (*in this case, when an invalid parent_id is provided*)

It’s up to you to make the failing tests pass :wink: 

**Additional notes**: as a suggestion, use the `find_by_id` method instead of `find`, it will return `nil` instead of raising an exception which will avoid the need for a `rescue` block.