- Use `@RestController` for API controllers, `@Service` for business logic, `@Repository` for data access.
- Keep controllers thin: parse request, validate, call service, return response.
- Use DTOs (Data Transfer Objects) for request/response — never expose JPA entities directly in controllers.
- Use `@RequestBody` with `@Valid` for automatic input validation via Bean Validation annotations.
- Use `@ExceptionHandler` or `@ControllerAdvice` for centralized error handling.
- Use DTOs for request/response. Never expose JPA entities directly in API responses.
- Use Spring Data repositories for standard CRUD. Add custom query methods only when needed.