The ponytail API example returned the raw ORM model, which exposes every
column. Restore a response_model whitelist (the trust boundary) while still
cutting the repository/service/exception ceremony. Matches the skill's own
'never cut security' rule.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>