e2f271fd35
Whole-branch review findings: 1. balanceHistory/monthlyFlow always returned 12 entries, even for a brand-new team with zero transactions, so the frontend's empty-state (gated on .length === 0) could never fire for a real "no movements yet" team. Now returns empty arrays when there are no relevant movements at all (not just none in the last 12 months, so a team with older-but-real history still gets a flat chart). Also added the same defensive `?? []` guard on players/transactions that getOverview already has, so a team with no players/relations loaded doesn't throw. 2. GET :id/overview/stats had no team-membership check -- any logged-in user (RoleEnum.user is the default role) could read any other team's financial stats by iterating ids. Injected TeamAccessService into TeamsService (already a sibling provider in TeamsModule, no module wiring needed) and call assertMember(actorUserId, teamId) as the first line of getOverviewStats, threaded from the controller via @Req(). Read access only (assertMember, not assertManager), matching who can already view the overview page. Sibling routes with the same pre-existing gap were left untouched, per review scope. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>