Server-side validation (no UI message yet)