Let a delegate read the dashboard they land on

Ten routes on `/` refused with `undeclared_mode`, which made the first page
of account sharing the only page in it that does not work. Each one now
declares a mode, per route rather than as a class.

Eight are record reads: the dashboard snapshot, the Today digest, the badge
grid, the Coach nudge signal and reminder ledger, the medication low-stock
thresholds, and the two presentation blobs. The old objection to admitting an
aggregate — a summary can carry a finding from a module the grant does not
cover — does not hold while a grant is whole-record and all-or-nothing. Every
admission site names that, so the day per-module scope lands the aggregates
are findable.

The layout routes split their verbs. Reading the owner's arrangement is right
and, for the dashboard, forced: the snapshot already carries the layout and
the client seeds the same cache cell from it, so an actor answer would put two
people's layouts in one key. Writing it is not a caregiver's job, so the PUT
and DELETE stay bare and refuse. Same on the medication list, where the stored
order names the owner's medication ids and means nothing anywhere else.

Two are actor surfaces: the UI language belongs to the person reading the
screen and must not be transplanted onto the record, and the feature-flag
matrix reads the settings singleton and no user row at all.

Also fixes a second instance of the delegate-data-under-owner-banner defect,
on the same page: the dashboard's client-side band fallback derived blood-
pressure targets and the weight range from `/api/auth/me`, which answers about
the caller, and painted them over the record's charts. Under a switch it now
derives nothing and waits for the snapshot's own bands.

The integration suite drives every admitted route with both accounts seeded,
proves the two answers differ, and then demands the owner's back.

src/app/api/settings/reminder-thresholds/route.ts

@@ -1,6 +1,6 @@
 import { apiSuccess } from "@/lib/api-response";
 import { getReminderThresholds } from "@/lib/app-settings";
-import { apiHandler, requireAuth } from "@/lib/api-handler";
+import { apiHandler, requireRecordAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
 import { prisma } from "@/lib/db";
 import { parseNotificationPrefs } from "@/lib/validations/notification-prefs";
@@ -8,8 +8,26 @@ import { parseNotificationPrefs } from "@/lib/validations/notification-prefs";
 export const dynamic = "force-dynamic";
 
 export const GET = apiHandler(async () => {
-  const { user } = await requireAuth();
+  // The RECORD's thresholds, and the third of the presentation trio — but the
+  // one where "presentation" understates it. These two numbers decide whether
+  // a medication card reads "low stock" and when it says to reorder, and the
+  // cards they colour are the OWNER's. Answering with the caller's runway
+  // would put the delegate's idea of "running out" on somebody else's supply:
+  // a helper who keeps a fortnight's buffer would see a warning on a cabinet
+  // its owner considers comfortable, or worse, miss one on a cabinet its owner
+  // does not.
+  //
+  // What this route projects out of `notificationPrefs` is exactly two
+  // integers. That object also holds channels, endpoints and quiet hours, and
+  // none of it is reachable from here — the two fields are named individually
+  // below, and the route that serves the object whole stays refused.
+  //
+  // No write arm exists, so there is nothing to split: a delegate cannot move
+  // the owner's threshold, only read the one the owner set.
+  const { user } = await requireRecordAuth("read");
 
+  // Operator-level singleton (`lateMinutes` / `missedMinutes`) — the same for
+  // every account on the deployment, so the switch does not touch it.
   const thresholds = await getReminderThresholds();
 
   // v1.16.11 — the low-stock runway threshold rides along so every