Exercise 1: Why Client-Side Validation Isn't Security — Possible Solution
====================================================================

WHY THE CHECK PROVIDES NO REAL SECURITY
------------------------------
if (!name.trim()) runs entirely inside JavaScript the browser executes
as part of this specific form's own code. Anyone who isn't using that
form at all - a hand-built curl request, a script, a browser's own
developer console making a direct fetch call - never runs this code in
the first place, and therefore never encounters the check. The check
only stops an empty name from being submitted through this particular
UI; it does nothing to stop a request that skips the UI entirely.

WHY IT STILL CORRECTLY PREVENTS EMPTY SUBMISSIONS THROUGH THE FORM
------------------------------
For a genuine user typing into the actual form and clicking Add Item,
the check does work exactly as intended - it stops the request before
it's even sent, giving instant feedback with no round trip. That's real
UX value, and the reason it's worth having. It just isn't the same thing
as a security boundary, since it only governs one specific, cooperative
path into the app.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly separates what the check actually does (stop one specific
UI path from submitting bad data) from what it doesn't do (stop any
other path from reaching the server), rather than treating "it works in
the form" as proof that the app itself is protected.