Skills Are Guidance, Not a Security Boundary: A Next.js Server Action That Stays Server-Side

How a barrel export with 'use client' can quietly pull server credentials into the browser bundle—and the ownership-scoped architecture that prevents it.