Build out the trainer role

is_trainer was captured at signup and stored, but nothing in the app
used it - no client roster, no way to assign anything, a dead flag that
misled users who checked it during registration.

Adds a trainer/client link (a trainer adds a client by the email they
registered with) and lets a trainer create workouts directly on a
client's account (assigned_by_trainer_id on workouts). Deliberately
scoped for privacy: a trainer only ever sees/manages the workouts they
authored and assigned - not a client's other private data (their own
workouts, weight log, health notes, session/completion history). That
boundary needs a consent or notification system to relax safely, which
doesn't exist yet, so it's left for a follow-up rather than building it
half-safe.

WorkoutController's authorization now distinguishes "manage" (owner or
assigning trainer - view, add/edit exercises) from "own" (owner only -
delete), so a trainer can build out an assigned workout's exercises
after creating it, but can't delete a client's workout out from under
them.

Found a real bug via live testing before committing: the client roster
page eager-loaded `assignedWorkouts` (keyed by assigned_by_trainer_id)
on each client record, which is the trainer's own perspective, not the
client's - so it silently showed "no workouts assigned" even after
assigning one. Fixed to eager-load `workouts` filtered by
assigned_by_trainer_id instead, with a regression test.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

resources/views/layouts/navigation.blade.php

@@ -20,6 +20,9 @@
                     @auth
                         <a href="{{ route('dashboard') }}" class="text-sm font-medium text-gray-700 dark:text-gray-300 hover:text-gray-900 dark:hover:text-white">{{ __('app.nav.dashboard') }}</a>
                         <a href="{{ route('programs.index') }}" class="text-sm font-medium text-gray-700 dark:text-gray-300 hover:text-gray-900 dark:hover:text-white">{{ __('app.nav.programs') }}</a>
+                        @if(Auth::user()->is_trainer)
+                            <a href="{{ route('trainer.clients') }}" class="text-sm font-medium text-gray-700 dark:text-gray-300 hover:text-gray-900 dark:hover:text-white">{{ __('app.nav.clients') }}</a>
+                        @endif
                         @if(Auth::user()->is_admin)
                             <a href="{{ route('admin.dashboard') }}" class="text-sm font-medium text-indigo-700 dark:text-indigo-300 hover:text-indigo-900 dark:hover:text-indigo-200">{{ __('app.nav.admin') }}</a>
                         @endif
@@ -100,6 +103,9 @@
             @auth
                 <x-responsive-nav-link :href="route('dashboard')">{{ __('app.nav.dashboard') }}</x-responsive-nav-link>
                 <x-responsive-nav-link :href="route('programs.index')">{{ __('app.nav.programs') }}</x-responsive-nav-link>
+                @if(Auth::user()->is_trainer)
+                    <x-responsive-nav-link :href="route('trainer.clients')">{{ __('app.nav.clients') }}</x-responsive-nav-link>
+                @endif
                 @if(Auth::user()->is_admin)
                     <x-responsive-nav-link :href="route('admin.dashboard')">{{ __('app.nav.admin') }}</x-responsive-nav-link>
                 @endif