Q1Why should request and response use separate DTOs, and where should entity↔DTO conversion live
Input and output are different shapes with different rules, so use a validated request DTO and a secret-free response DTO, and do the entity mapping in the service layer, not the controller.