Build out the trainer role

is_trainer was captured at signup and stored, but nothing in the app
used it - no client roster, no way to assign anything, a dead flag that
misled users who checked it during registration.

Adds a trainer/client link (a trainer adds a client by the email they
registered with) and lets a trainer create workouts directly on a
client's account (assigned_by_trainer_id on workouts). Deliberately
scoped for privacy: a trainer only ever sees/manages the workouts they
authored and assigned - not a client's other private data (their own
workouts, weight log, health notes, session/completion history). That
boundary needs a consent or notification system to relax safely, which
doesn't exist yet, so it's left for a follow-up rather than building it
half-safe.

WorkoutController's authorization now distinguishes "manage" (owner or
assigning trainer - view, add/edit exercises) from "own" (owner only -
delete), so a trainer can build out an assigned workout's exercises
after creating it, but can't delete a client's workout out from under
them.

Found a real bug via live testing before committing: the client roster
page eager-loaded `assignedWorkouts` (keyed by assigned_by_trainer_id)
on each client record, which is the trainer's own perspective, not the
client's - so it silently showed "no workouts assigned" even after
assigning one. Fixed to eager-load `workouts` filtered by
assigned_by_trainer_id instead, with a regression test.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

routes/web.php

@@ -60,6 +60,15 @@ Route::middleware('auth')->prefix('/workouts')->group(function () {
     Route::post('/{workout}/sessions', [\App\Http\Controllers\WorkoutSessionController::class, 'store'])->name('sessions.store');
 });
 
+// Trainer: manage clients and assign workouts to them
+Route::middleware(['auth', 'trainer'])->prefix('/trainer')->group(function () {
+    Route::get('/clients', [\App\Http\Controllers\TrainerController::class, 'clients'])->name('trainer.clients');
+    Route::post('/clients', [\App\Http\Controllers\TrainerController::class, 'addClient'])->name('trainer.clients.add');
+    Route::delete('/clients/{client}', [\App\Http\Controllers\TrainerController::class, 'removeClient'])->name('trainer.clients.remove');
+    Route::get('/clients/{client}/workouts/create', [\App\Http\Controllers\TrainerController::class, 'createWorkout'])->name('trainer.workouts.create');
+    Route::post('/clients/{client}/workouts', [\App\Http\Controllers\TrainerController::class, 'storeWorkout'])->name('trainer.workouts.store');
+});
+
 Route::middleware('auth')->prefix('/programs')->group(function () {
     Route::get('/', [\App\Http\Controllers\ProgramController::class, 'index'])->name('programs.index');
     Route::get('/create', [\App\Http\Controllers\ProgramController::class, 'create'])->name('programs.create');