Separate HTTP Concerns from Business Logic
Routes should describe entry points, not contain the whole system.
A common and practical structure is to keep routes thin, controllers focused on HTTP translation, services focused on business rules, and middleware focused on cross-cutting concerns.
That separation makes testing easier because each piece has a clearer reason to change.
- `routes/` define endpoints
- `controllers/` translate request to use case
- `services/` hold the business rules
- `middlewares/` handle concerns like validation, auth, and logging