fix(insights): let a read grant read the record's targets

The weight band and the BMI chart read `/api/insights/targets` inside a
shared record, and the route asked for a manage grant, so a read or
write delegate got a 403 and saw no band and no BMI. The targets are
the bands the dashboard snapshot already paints on a whole-record read
grant, computed with no provider, so the read now asks for the same
level. A section-scoped grant is still refused.

src/app/api/insights/targets/route.ts

@@ -15,9 +15,10 @@ import { buildTargetsResponse } from "@/lib/targets/build-response";
 export const dynamic = "force-dynamic";
 
 export const GET = apiHandler(async () => {
-  // v1.37.0 — MANAGE-level read: computed over the whole record, with no
-  // provider anywhere on the path.
-  const { user } = await requireRecordAuth("manage", "record");
+  // A read of the whole record, with no provider anywhere on the path, at the
+  // level the dashboard snapshot answers: the weight band and the BMI chart
+  // read it inside a shared record, and a read or write grant got a 403.
+  const { user } = await requireRecordAuth("read", "record");
   // v1.16.8 — stale-while-revalidate read. The cold build is the multi-query
   // walk in `buildTargetsResponse`; past the 60 s fresh TTL the prior body
   // serves immediately while ONE background rebuild warms the cell. Writes