Is “API first” principle obsolete nowadays?
How can Server Actions allow other clients to use the same backend?
That was the whole point of SPAs, mobile clients communicating only over REST/GraphQL so that you can add more clients/automation/consumers later.
To do that properly, the endpoint needs to be secured and documented (Swagger or GraphiQL with autogeneration of client libraries in most languages).