- Use `[ApiController]` attribute for automatic model binding and validation.
- Keep controllers thin: inject services, call methods, return `IActionResult`.
- Use ViewModels for view-specific data shapes — never expose domain entities directly to Razor views or API consumers.
- Use `ActionResult<T>` for typed responses with proper status codes.
- Use `[FromBody]`, `[FromQuery]`, `[FromRoute]` for explicit parameter binding.
- Apply `[Authorize]` at the controller level and override with `[AllowAnonymous]` on specific actions when needed.
- Use `IActionFilter` or `IAsyncActionFilter` for pre/post-processing logic.