We did not add a separate API package. Mutations are Server Actions next to the pages that call them, with a thin src/lib/db layer so queries are not copy-pasted into every form.
What we refused
No extra RPC surface “for later.” No generated client that duplicates types we already have in database.types.ts. The form posts, the action checks the session, Postgres enforces the rest.
The ceremony that is worth it: mapping rows into the existing frontend types so cards and studio tables did not have to learn snake_case.