fix(openapi): set explicit response_model for meals v2 get-by-id; plus security hardening and v2 endpoints

api/meals_v2.py

@@ -67,6 +67,7 @@ async def get_upcoming_meals_scoped(
     "/{meal_id}",
     operation_id="getMealV2",
     summary="Get a meal by id (scoped)",
+    response_model=meals.Meal,
     responses={404: {"model": ProblemDetails}},
 )
 async def get_meal_scoped(