Thanks for the post.
For your information though, HATEOAS is definitely not "an extra level upon REST", it is an integral part of it. Just read what Roy Fielding said on this topic :
"I am getting frustrated by the number of people calling any HTTP-based interface a REST API. Today’s example is the SocialSite REST API. That is RPC. It screams RPC. There is so much coupling on display that it should be given an X rating.
What needs to be done to make the REST architectural style clear on the notion that hypertext is a constraint? In other words, if the engine of application state (and hence the API) is not being driven by hypertext, then it cannot be RESTful and cannot be a REST API. Period. Is there some broken manual somewhere that needs to be fixed?"

If the collection is empty the resources will not return _embedded array which will break the client.
https://stackoverflow.com/q...
This thread fixed the issue but it's not elegant at all. Any idea how to fix this?

for the get all people request CURL localhost:8090/people we can see it has added embeded object list as "personResourceList" can we override to have "personResource"

For POST you return the created entity in the body. This not HATEOAS. To make it HATEOAS conform, your POST method should only return a URI pointing to the created entity. If client needs this resource, it will load it then via GET.