Google Login Complete

Bounded campaign data accepted only during account creation.

The user account in the shape a client may see.

Endpoints that hand a User row back go through this DTO, so the bcrypt hash never leaves the server. The signup forensics — ip_address, signup_attribution, referred_by_miner_id, referred_by_code_id — stay out for the same reason: no client reads them (GET /users/me shows the partner code itself as referred_by, built by UserService.get_user_info).