📈 Overview
All-user data is read by /api/coach-overview, which holds the service-role key server-side and verifies this is the coach account before returning anything. The browser key on this page cannot read across users — row-level security scopes it to your own rows.