Let a delegate read the dashboard they land on

Ten routes on `/` refused with `undeclared_mode`, which made the first page
of account sharing the only page in it that does not work. Each one now
declares a mode, per route rather than as a class.

Eight are record reads: the dashboard snapshot, the Today digest, the badge
grid, the Coach nudge signal and reminder ledger, the medication low-stock
thresholds, and the two presentation blobs. The old objection to admitting an
aggregate — a summary can carry a finding from a module the grant does not
cover — does not hold while a grant is whole-record and all-or-nothing. Every
admission site names that, so the day per-module scope lands the aggregates
are findable.

The layout routes split their verbs. Reading the owner's arrangement is right
and, for the dashboard, forced: the snapshot already carries the layout and
the client seeds the same cache cell from it, so an actor answer would put two
people's layouts in one key. Writing it is not a caregiver's job, so the PUT
and DELETE stay bare and refuse. Same on the medication list, where the stored
order names the owner's medication ids and means nothing anywhere else.

Two are actor surfaces: the UI language belongs to the person reading the
screen and must not be transplanted onto the record, and the feature-flag
matrix reads the settings singleton and no user row at all.

Also fixes a second instance of the delegate-data-under-owner-banner defect,
on the same page: the dashboard's client-side band fallback derived blood-
pressure targets and the weight range from `/api/auth/me`, which answers about
the caller, and painted them over the record's charts. Under a switch it now
derives nothing and waits for the snapshot's own bands.

The integration suite drives every admitted route with both accounts seeded,
proves the two answers differ, and then demands the owner's back.

src/app/api/coach/reminders/route.ts

@@ -17,7 +17,7 @@
  * for the in-app tile). Omitted returns the non-terminal set (proposed / active
  * / due / surfaced), soonest-due first.
  */
-import { apiHandler, requireAuth } from "@/lib/api-handler";
+import { apiHandler, requireAuth, requireRecordAuth } from "@/lib/api-handler";
 import {
   apiError,
   apiSuccess,
@@ -69,7 +69,17 @@ function toDto(row: ReminderRow, note: string) {
 }
 
 export const GET = apiHandler(async (req: Request) => {
-  const { user } = await requireAuth();
+  // The RECORD's reminder ledger. A "remind me about X" note is a statement
+  // about the owner's own health, stored on the owner's row and encrypted with
+  // it — the same shape as a mood note or a measurement note, both of which
+  // are already delegable reads. A delegate reading it is the caregiver case
+  // the feature exists for; an actor answer here would light the FAB's dot for
+  // the delegate's own ledger while the page shows another person's record,
+  // which is the failure mode this whole mode system exists to prevent.
+  //
+  // The module gate below resolves against the record, so the surface exists
+  // for a delegate only where the OWNER switched the Coach on.
+  const { user } = await requireRecordAuth("read");
   const gate = await requireModuleEnabled(user.id, "coach");
   if (!gate.enabled) return gate.response;
 
@@ -121,6 +131,13 @@ export const GET = apiHandler(async (req: Request) => {
 });
 
 export const POST = apiHandler(async (req: Request) => {
+  // Deliberately still bare, so it refuses under a switch. Writing into
+  // somebody else's Coach memory is not adding a reading to their record: the
+  // note is what the Coach reads back to the OWNER in their own conversation,
+  // and putting a delegate's words in that voice is not a thing a caregiver
+  // grant should buy. A delegate who wants to record something writes it where
+  // it belongs — a measurement, a side effect, an allergy — all of which are
+  // delegable creates that file an audit row naming them.
   const { user } = await requireAuth();
   const gate = await requireModuleEnabled(user.id, "coach");
   if (!gate.enabled) return gate.response;