- Layered: Controller β Service β Repository
- DTOs are Java records. Never expose JPA entities in API responses.
- Constructor injection only. No field injection.
- No catch-all
catch (Exception e). Handle specific exceptions. - Validate inputs at the controller layer using Jakarta Validation.