Sub-ticket of PLUTO-729 Audit sweep: which 'use server' exports are reachable unguarded by anonymous POST (PLUTO-27 found three; the surface is much larger and needs a real analysis, not a grep) · pluto