Server architecture (reference)
app/ routes → Server Actions / Route Handlers (authZ + Zod) → server/services → Drizzle queries → Supabase PG (RLS)
No DB calls in components. Every mutation validates input, checks workspace membership + role, and writes an audit row.