Why not just return JPA `@Entity` objects directly from a REST controller?

Entities carry lazy-loaded relationships that can throw `LazyInitializationException` once serialized outside a transaction, they leak internal DB columns you may not want public (audit fields, foreign keys), and every schema change becomes an uncontrolled API contract change. A DTO is a plain object shaped exactly like the API response you intend, decoupling your database schema from your public contract.