The only place it make sense to me is the validation = at the route level you want to ensure that the given model exists / request attributes defining relationship (pivot), are there. This is how Laravel does this. Having said that this should be responsibity of domain rather than application

Yeah, this was the big red flag for me too. If you're going to try to decouple things, the last thing you should do is add more coupling.

the connection, schema, and migrations are all separated so looks pretty easy to swap in your own ORM or have another service own data