roles: guest < parent < player < coach < manager < admin — uploads need parent+, tagging coach+, setup manager+, this page admin. Associate players to give a parent/player their FAMILY page (a parent can have several — twins!).

cloud note: with the admin key configured (DEPLOY.md step 5), adding a user here ALSO emails their sign-in invite and role changes sync to Supabase automatically. Without it, invites are manual (Supabase → Authentication → Users) and access roles are the SQL snippet in DEPLOY.md 1c.