service adapts HTTP-facing DTOs to business usecases and owns application
orchestration. Request/response/filter contracts live in dto/; the root
package contains resource services, conversions, and security
coordination.
dto_alias.go is a compatibility bridge for existing service callers. New
transport code should import service/dto directly when it needs a contract.
