content has been deleted

looks nice! just from a basic run-through of the code, it looks like there's pretty minimal error handling for form data that doesn't exist. i suppose it might be on the client and I just didn't see it, but the API routes seem to just assume everything is being passed correctly.

content has been deleted

i don't think it's necessarily required for you to add it to your server code - maybe if you eventually wanted to make the API a separate offering, it would be handy then. but really that's up to you.

i think more generally, server code should be the source of truth of the requirements of form fields, and any front-end validation is sugar on top.