Client-side validation matches server-side

Client-side validation is UX; server-side validation is security. When the two diverge, the gap is exploitable: a client that allows $0.01-$9,999.99 but a server with no upper bound means any user who bypasses the form (curl, Burp, modified JS) can submit arbitrary amounts. CWE-602 (Client-Side Enforcement of Server-Side Security) and OWASP A03 both flag this pattern. Parity isn't just a correctness concern — inconsistent constraints produce confusing UX when server validation rejects what the client accepted.

Extract shared validation into a single Zod schema in src/lib/schemas.ts that both the React form resolver and the API route import. This mechanically prevents drift.

// src/lib/schemas.ts
export const transferSchema = z.object({
  amountCents: z.number().int().min(1, 'Minimum $0.01').max(99999, 'Maximum $999.99'),
  routingNumber: z.string().refine(isValidABARoutingNumber, 'Invalid routing number'),
});

// src/components/TransferForm.tsx
const form = useForm({ resolver: zodResolver(transferSchema) });

// src/app/api/transfers/route.ts
const data = transferSchema.parse(await req.json());