API Route Conventions

All mutations go through Route Handlers — there are no Server Actions ("use server").

Reference implementation: app/api/jobs/applications/[id]/route.ts

Handler structure

/** PATCH /api/jobs/applications/[id] */
export async function PATCH(
  req: NextRequest,
  { params }: { params: Promise<{ id: string }> },
) {
  const { user, error: authError } = await requireUser()
  if (authError) return authError