All together
Build the menu admin service: the controller is written; you write the service that uses the injected repository, enforces the business rules and throws the right exceptions.
Finishing like a professional
Before calling the capstone done, walk through every endpoint once with good input and once with bad input. Then read your service from top to bottom: each method should be short, every rule should be obvious, and no method should reach for HTTP details or the database client directly.
This is the same checklist senior developers use in code review. Clear names, a single place for each rule and helpful error messages matter as much as passing tests, because the next person to change this code may be you in six months.