Start here. This is the direct spoken answer to practice first.
Overview
Validation belongs at the narrowest level that owns all required values, and remote checks need explicit concurrency behavior.
I attach a field rule to one control and a cross-field rule to the group or schema node that owns all participating values. For an asynchronous check, I debounce where appropriate, avoid requests for obviously invalid input, and ensure a response for an old value cannot overwrite the latest state. The server still validates on submission because client validation is not a trust boundary.