Keep model calls server-side
Why
Provider keys, instructions, request validation, token limits, and fallback behavior belong behind the TanStack Start boundary.
Tradeoff
The browser cannot call the model directly, so the server route has to own streaming translation and error handling.
Result
The client receives only application-owned stream events and never sees secrets, raw provider events, or protected instructions.
