The logic has to run server side either way.. but that's obvious. Otherwise any idiot with an API key has full control over your system. That's why you don't "make a pure REST API which provides low-level CRUD operations" as you've suggested. If you have invariants which must be held then you can't do that - and with any meaningful system you will have such invariants.

Frontend? You can implement it in a shared library and cross compile. Or implement it in a DSL and interpret (or compile) that for each target platform.

Is that overkill? Then implement the bits (it's almost always a subset) you need in the frontend.

Don't like that but your app can assume an internet connection? Then keep a connection open (i.e. Signal R) and call procedures on the server.