BE-035: Enforce can_view_body flag on body endpoints

Track: 1 — MVP
Section: 1.11 Coach-Client Permissions
Status: [ ] Todo
Repo: backend-api
Branch: feature/BE-035-enforce-can-view-body

Done When

Same pattern for GET /coach/clients/{id}/body. 403 when denied, 200 when allowed

Notes

No notes yet.