BE-034: Enforce can_view_health flag on health endpoints

Track: 1 — MVP
Section: 1.11 Coach-Client Permissions
Status: [ ] Todo
Repo: backend-api
Branch: feature/BE-034-enforce-can-view-health

Done When

Coach calls GET /coach/clients/{id}/health/summary with can_view_health=false in permissions → 403. With true → 200 with data

Notes

No notes yet.