You can't in general prevent clients from sabotaging themselves. In the extreme case, someone makes a separate page that's supposed to call your API, but just... doesn't work.

The point of the UUID system is to prevent the client from failing due to things that are outside its control; specifically, the actions of other clients.

Nothing. But you'll get a constraint error as they aren't unique.

Nothing, why would that be an issue (IE the same client submitting requests with two identical UUIDs)?