Http Status Ownership

Do not set HTTP status codes directly outside the centralized API response layer.

Correct

return ok({ data })
clientError('invalidRequest')

Incorrect

return res.status(200).json(data)
return response.status(400).json(error)

Fix

Return the API result or use the appropriate centralized error helper instead of setting the status directly.