If you are using PostgREST as intended, you don't have an application layer any more. It's not something extra you put in between the application and the database, but it replaces the application.
No the logic is in the database. They encourage you to write functions to achieve custom logic in the database. Search for `create or replace function` in their tutorial to see an example.
Yeah that is also something I don't want to do, after having used Hasura at a previous place. After a while, the logic gets convoluted when it's all in the database only.