Validate every submission on the server as well

Client validation with required, type="email" and pattern gives fast feedback, but anyone can bypass it with the dev tools or a direct request.

Server Functions marked with 'use server' are reachable as public endpoints, so inside the function itself check:

1. Authentication: who is calling.
2. Authorization: whether they may change this specific record.
3. Every field: parse the input with a schema library such as Zod to get typed data.

Return field errors to useActionState so the form can show them next to the right input.