Google Login Complete

Bounded campaign data accepted only during account creation.

The user account in the shape a client may see.

Endpoints that hand a User row back go through this DTO, so the bcrypt hash never leaves the server. The signup forensics — ip_address, signup_attribution, referred_by_miner_id — stay out for the same reason: no client reads them.