Security hardening across the API

We audited what the API returns and tightened it so responses carry only the data a client actually needs.

Jobs return a signed download URL and output metadata. Usage reporting shows what you were charged. The rest stays where it belongs.

The principle is that a response carries what a caller needs to act on and nothing that describes how the platform is built internally. Storage keys, internal upload identifiers, and provider-side run ids are the sort of thing that leaks the shape of the system without helping anyone integrate.

This is now a standing rule rather than a one-off sweep. Every change that adds a field to a response or a column to a table gets audited before it ships, so the surface stays deliberate as the API grows.

What a job returns is documented under job lifecycle, and every code the API can raise is listed in error codes.