Server actions
Business mutations generally flow through validated server actions under `apps/web/app/actions`.
Use shared validation and typed action result envelopes for predictable error handling.
HTTP routes
API handlers live under `apps/web/app/api` and should follow auth, rate-limit, and CSP expectations.
Example action pattern
Replace this placeholder with real endpoint references as your API surface evolves.
Typed action result
type ActionResult<T> = { success: true; data: T } | { success: false; error: string }
export async function exampleAction(): Promise<ActionResult<{ ok: boolean }>> {
return { success: true, data: { ok: true } }
}