fix(auth): resolve Prisma alunoId vs Auth UUID in delete+update authorization

deleteTreinoAction and updateTreinoDayAction compared treino.alunoId
(Prisma ID) against user.id (Auth UUID), always mismatching after
PR #174 FK fix. Resolve aluno.id by email before auth check.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: EmiyaKiritsugu3

src/lib/actions/treinos.ts

@@ -243,10 +243,13 @@ export async function updateTreinoDayAction(treinoId: string, diaSemana: number
           select: { instrutorId: true, alunoId: true },
         });
 
+        // Resolve aluno.id from Auth email — treino.alunoId is Prisma ID, user.id is Auth UUID
+        const alunoConsulta = await prisma.aluno.findUnique({ where: { email: user.email ?? '' } });
+
         if (
           funcData?.role !== 'GERENTE' &&
           treino?.instrutorId !== user.id &&
-          treino?.alunoId !== user.id
+          treino?.alunoId !== alunoConsulta?.id
         ) {
           return { success: false, error: 'Acesso não autorizado' };
         }
@@ -286,10 +289,13 @@ export async function deleteTreinoAction(treinoId: string) {
           select: { instrutorId: true, alunoId: true },
         });
 
+        // Resolve aluno.id from Auth email — treino.alunoId is Prisma ID, user.id is Auth UUID
+        const alunoConsulta = await prisma.aluno.findUnique({ where: { email: user.email ?? '' } });
+
         if (
           funcData?.role !== 'GERENTE' &&
           treino?.instrutorId !== user.id &&
-          treino?.alunoId !== user.id
+          treino?.alunoId !== alunoConsulta?.id
         ) {
           return { success: false, error: 'Acesso não autorizado' };
         }