Server core conventions (design D6: transport-agnostic core) #

A future native frontend (Deno desktop, mobile) must be able to target a standalone Quantum backend. To keep that cheap, the server core follows these rules:

1. Domain logic lives in services/. Every domain operation (ledger queries, categorization, rules, reports, sync, account classification) is a plain function in src/lib/server/services/ taking typed inputs and returning plain data. No Request/Response, no cookies, no SvelteKit imports.
2. Routes are thin adapters. +page.server.ts loads and form actions only parse input, call a service, and shape the response. No SQL and no domain logic in routes. When native clients arrive, /api/* JSON routes become a second adapter over the same services.
3. No SQL outside services/ and db.ts.
4. Relative imports within src/lib/server/ (not $lib/...) so modules and their tests run under plain deno test without Vite alias resolution.
5. Sessions are opaque tokens. Delivered via HTTP-only cookie today; the token format must never assume cookie transport (bearer support later).
6. Money is integer cents. Conversion from SimpleFIN's numeric strings happens exactly once, at normalization. Floats never touch amounts.